registry / @trustbaseai/claude-collab-plugin / 0.3.1

@trustbaseai/claude-collab-plugin@0.3.1

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit install command persists package-owned Claude Code hooks. Those hooks forward local tool-activity summaries to the configured collaboration client and inject polled collaboration messages into future Claude context; optional auto-wake launches a headless Claude session.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `claude-collab-plugin install`; watch and auto-wake require separate explicit CLI invocation and flags.

Impact

Tool metadata and selected Bash commands can be sent through `collab-send`; externally supplied collaboration messages can influence Claude sessions.

Mechanism

Persistent AI-agent hooks plus collaboration-message forwarding and context injection.

Rationale

The scanner’s malicious label overstates the evidence: activation is explicit and package-owned, with no npm lifecycle execution. The documented persistent hooks nevertheless create a real collaboration-mediated agent-control surface and automatic tool-summary forwarding, warranting a warning.

Evidence

package.jsonsrc/settings.jssrc/hooks.jsbin/claude-collab-plugin-install.jsbin/claude-collab-plugin-watch.jsscripts/claude-posttool-hook.jsscripts/claude-sessionstart-hook.jsscripts/claude-userpromptsubmit-hook.jsscripts/claude-auto-wake.js~/.claude/settings.json~/.claude/settings.json.bak.<timestamp>~/.claude/projects/<project>/*.jsonl~/.claude-collab/config.jsonD:/myopenclaw/.tmp/claude-pending-baobei.jsonD:/myopenclaw/.tmp/.claude-posttool-hook.last

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/settings.js` writes three persistent Claude hooks to `~/.claude/settings.json` when the user runs install.
`scripts/claude-posttool-hook.js` forwards summaries of Edit/Write/NotebookEdit and selected Bash commands via `collab-send baobei`.
`bin/claude-collab-plugin-watch.js` polls `collab-read`, writes received content to a pending file, and the hooks inject it as Claude `additionalContext`.
`scripts/claude-auto-wake.js` can launch `claude --print` on received messages when explicit `--auto-wake` is used.
`scripts/claude-posttool-hook.js` contains a credential-like value in a comment; it is not used as executable configuration.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
Hook installation is reached only through documented `claude-collab-plugin install`, not package installation or import.
The installer uses package-specific markers, preserves other hooks, writes backups, and provides an uninstall command.
No direct HTTP client, remote code download, eval, destructive deletion, or credential-file exfiltration is present in this package.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 55.0 KB of source

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/claude-collab-plugin@0.3.0 matchedIdentity = npm:[redacted]:0.3.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/claude-collab-plugin.jsView file

61// Fallback: spawn `collab-doctor --version` (or scan its --json for version). L62: const { spawnSync } = require('child_process'); L63: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

66windowsHide: true, L67: shell: true, L68: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

15L16: const path = require('path'); L17:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Findings

1 Critical3 High3 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/claude-collab-plugin-watch.js

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

90%Warn

Verdict confidence

IntentDangerous Capability

TypeAgent extension lifecycle risk

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only agent extension risk

Package metadata

npm

Authoroxiaom

Maintainersoxiaom

Version0.10.0

PublishedJul 16, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size22.3 KB

Files25

Keywordsclaude-codeclaude-collabpluginhookssettings.jsonmcpmulti-agent

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → claude-collab-plugin, claude-collab-plugin-doctor, claude-collab-plugin-install +3

Runtimenode >=18

Artifact74.0 KB · 25 files1 signature(s)

Install lifecycleNo install hooks · other: check, doctor, test

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemShellHighEntropyStringsManifest: clean

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg