registry / @spzhongwin/skill-logger-plugin / 1.1.4

@spzhongwin/skill-logger-plugin@1.1.4

Skill Logger 是 Aishuo 面向 OpenClaw Gateway 的运行期插件，用于记录 Skill 和工具调用、同步平台配置，并提供用户自建 Skill 的管理工具。

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Source inspection confirms service-directed writes to agent expert files without a local approval step, so this merits a warning for agent extension lifecycle risk. The manifest has no install-time hook, and the inspected source does not support a publish block.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review

Trigger

OpenClaw starts the gateway and the connected service sends an INSTALL_EXPERT command.

Impact

The installed files can affect the agent's later behavior. The command path has no explicit local approval step.

Mechanism

The command provides a ZIP URL; the plugin downloads and unpacks it, checks for AGENTS.md and SOUL.md, and replaces the target expert directory.

AI rationale

Evidence

package.jsondist/index.jssrc/index.tssrc/ws-client.tssrc/updater.tsAGENTS.mdSOUL.md

Network endpoints1

wss://aishuo.co/gateway/ws

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The package exports its bundled entrypoint and has a prepublishOnly quality-check script, with no npm install-time hook.
When the gateway starts, the plugin connects to a configured central service or its default WebSocket endpoint; incoming messages reach the command handler.
An INSTALL_EXPERT message supplies a download URL and can install an expert under the agent workspace without a local approval step in that path.
The updater downloads and unpacks the supplied ZIP, requires AGENTS.md and SOUL.md, then replaces the expert directory. The runtime and tests confirm those files define the expert layout.

Evidence against

The download path is an expert ZIP installer; the inspected source does not establish a separate arbitrary-code execution chain.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStrings

Source & flagged code

10 flagged

src/free-skill-lock.test.tsView file

Lines 1-21typescript

1import assert from "node:assert/strict";

2import {spawnSync} from "node:child_process";

3import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

4import os from "node:os";

5import path from "node:path";

6import {setTimeout as delay} from "node:timers/promises";

7import {test, afterEach} from "node:test";

8import {withFreeSkillLock} from "./free-skill-lock.ts";

9import {createFreeSkillToolFactory} from "./free-skill-tool.ts";

11const roots: string[] = [];

12afterEach(async () => {await Promise.all(roots.splice(0).map(root => fs.rm(root, {recursive: true, force: true})));});

13async function workspace() {

14 const root = await fs.mkdtemp(path.join(os.tmpdir(), "skill-lock-review-"));

15 roots.push(root);

16 return root;

17}

18async function fakeOwner(root: string, pid: number, createdAt: string) {

19 const lock = path.join(root, ".xg-workspace/skills/locks/write");

20 await fs.mkdir(lock, {recursive: true});

21 await fs.writeFile(path.join(lock, "owner.json"), JSON.stringify({pid, createdAt}));

scripts/verify-esm.mjsView file

Lines 1-12javascript

1import { readFile } from "node:fs/promises";

3const bundlePath = new URL("../dist/index.js", import.meta.url);

4const

dist/index.jsView file

Lines 21-61javascript

21 const agent = asRecord(value);

22 const id = typeof agent?.id === "string" ? agent.id.trim() :

package.jsonView file

Lines 1-29json

2 "name": "@spzhongwin/skill-logger-plugin",

3 "version": "1.1.4",

4 "type": "module",

5 "engines": {

6 "node":

scripts/verify-compat.mjsView file

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

scripts/verify-compat.mjsView on unpkg

src/config-sync.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/config-sync.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/config-sync.tsView on unpkg

src/matcher.test.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.test.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.test.tsView on unpkg

src/matcher.tsView file

•matchType = normalized_sha256 matchedPackage = @spzhongwin/sk[redacted]@1.0.30 matchedPath = src/matcher.ts matchedIdentity = npm:[redacted]:1.0.30 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

src/matcher.tsView on unpkg

Source & flagged code

10 flagged · loading source

src/free-skill-lock.test.tsView file

1import assert from "node:assert/strict"; L2: import {spawnSync} from "node:child_process"; L3: import fs from "node:fs/promises";

High

Child Process

Package source references child process execution.

src/free-skill-lock.test.tsView on unpkg · L1

scripts/verify-esm.mjsView file

6if (/\b__require\s*\(/.test(source)) { L7: throw new Error("ESM bundle contains esbuild dynamic __require(); externalize or replace the CommonJS dependency"); L8: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/verify-esm.mjsView on unpkg · L6

dist/index.jsView file

Findings

3 Critical5 High5 Medium6 Low

CriticalRemote Asset Decode Executedist/index.js

CriticalAi Agent Control Hijackdist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processsrc/free-skill-lock.test.ts

HighSemantic Analysis Limitedscripts/verify-compat.mjs

HighKnown Malware Source Similaritysrc/config-sync.ts

HighKnown Malware Source Similaritysrc/matcher.test.ts

HighKnown Malware Source Similaritysrc/matcher.ts

MediumDynamic Requirescripts/verify-esm.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

Medium

Affected versions and remediation

This report applies to @spzhongwin/skill-logger-plugin@1.1.4.

See all versions of @spzhongwin/skill-logger-plugin for other recorded verdicts.

Review the evidence and your use of @spzhongwin/skill-logger-plugin@1.1.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-15 06:22:15.607Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.