registry / @trustbaseai/claude-collab-plugin / 0.3.0

@trustbaseai/claude-collab-plugin@0.3.0

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

With `watch --auto-wake`, collab message content reaches a shell-enabled `claude` child-process invocation. Crafted message text can be interpreted by the shell, enabling command execution as the invoking user.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `claude-collab-plugin watch --auto-wake` and a new collab message is received.

Impact

Potential remote command execution as the local user; installed hooks also disclose selected command summaries to the configured collab service.

Mechanism

Network-derived message content passed to `spawnSync` with `shell: true`.

Rationale

The package is not install-time malware, but its opt-in auto-wake flow has a concrete shell-injection/RCE risk from remote message content. Its explicit Claude hook installation and command-summary forwarding add meaningful agent-control and data-disclosure exposure.

Evidence

package.jsonbin/claude-collab-plugin-watch.jsscripts/claude-auto-wake.jsscripts/claude-posttool-hook.jssrc/hooks.jssrc/settings.jsD:/myopenclaw/.tmp/claude-pending-baobei.json~/.claude/settings.json

Decision evidence

public snapshot

AI called this Suspicious at 95.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

`scripts/claude-auto-wake.js` builds a `claude --print` prompt from pending message content.
It invokes `spawnSync('claude', args2, { shell: true })` with that untrusted content.
`bin/claude-collab-plugin-watch.js` writes `collab-read` message bodies to the pending file, then invokes auto-wake when explicitly enabled.
`scripts/claude-posttool-hook.js` forwards notable Bash command summaries to `collab-send`.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
Importing `src/index.js` only exposes modules; it does not install hooks or start a daemon.
Claude settings changes require the explicit `claude-collab-plugin install` command and preserve backups.
No static external endpoint is embedded in the active send/read implementation.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 55.0 KB of source

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/claude-collab-plugin@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 0.692 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/claude-collab-plugin.jsView file

61// Fallback: spawn `collab-doctor --version` (or scan its --json for version). L62: const { spawnSync } = require('child_process'); L63: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

66windowsHide: true, L67: shell: true, L68: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

15L16: const path = require('path'); L17:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Findings

1 Critical3 High3 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/claude-collab-plugin-watch.js

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg