registry / @trustbaseai/claude-collab-plugin / 0.5.1

@trustbaseai/claude-collab-plugin@0.5.1

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Run `claude-collab-plugin install`; additionally run `claude-collab-plugin watch --auto-wake` for the sub-session path.

Impact

Tool activity metadata can be forwarded to the configured collab service; a malicious inbound message may influence a Bash-enabled sub-session that bypasses approvals.

Mechanism

Claude hook persistence, collab message forwarding, and prompt-injected auto-wake with skipped approvals.

Rationale

This is not an install-time malware chain: no npm lifecycle script runs and configuration changes require explicit commands. However, the optional auto-wake path combines externally sourced prompt content with `--allow-dangerously-skip-permissions`, creating a concrete dangerous AI-agent capability.

Evidence

package.jsonsrc/settings.jssrc/hooks.jsscripts/claude-posttool-hook.jsscripts/claude-auto-wake.jsbin/claude-collab-plugin-watch.js~/.claude/settings.jsonscripts/claude-sessionstart-hook.jsscripts/claude-userpromptsubmit-hook.js

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`src/hooks.js` explicitly installs three Claude hooks into `~/.claude/settings.json`.
`scripts/claude-posttool-hook.js` forwards edited-file/Bash summaries through `collab-send`.
`bin/claude-collab-plugin-watch.js` reads mailbox content and writes it for hook injection.
`scripts/claude-auto-wake.js` injects inbound messages into `claude --print` with `--allow-dangerously-skip-permissions` and Bash allowed.
Auto-wake sends model output using `collab-send` and acknowledges mailbox messages.

Evidence against

`package.json` has no preinstall, install, postinstall, or prepare lifecycle hook.
Hook mutation occurs only after the explicit `claude-collab-plugin install` command.
Auto-wake is off unless the user explicitly supplies `watch --auto-wake`.
Source contains no direct HTTP client, credential harvesting, binary loading, or remote code download.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 62.0 KB of source

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/claude-collab-plugin@0.3.7 matchedIdentity = npm:[redacted]:0.3.7 similarity = 0.867 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/claude-collab-plugin.jsView file

61// Fallback: spawn `collab-doctor --version` (or scan its --json for version). L62: const { spawnSync } = require('child_process'); L63: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

66windowsHide: true, L67: shell: true, L68: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

15L16: const path = require('path'); L17:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Findings

1 Critical3 High3 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/claude-collab-plugin-watch.js

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

94%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskLow

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

Authoroxiaom

Maintainersoxiaom

Version0.10.0

PublishedJul 16, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size24.4 KB

Files25

Keywordsclaude-codeclaude-collabpluginhookssettings.jsonmcpmulti-agent

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → claude-collab-plugin, claude-collab-plugin-doctor, claude-collab-plugin-install +3

Runtimenode >=18

Artifact81.0 KB · 25 files1 signature(s)

Install lifecycleNo install hooks · other: check, doctor, test

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemShellHighEntropyStringsManifest: clean

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-86javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * session Print most recent Claude Code session state

11 * version Print plugin + base version

12 * help This help

13 */

14'use strict';

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L15

18const subcommands = {

19 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

20 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

21 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

22 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

23 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

24 version: { desc: 'Print plugin + base version' },

25 help: { desc: 'This help' },

26};

28const [, , cmd, ...rest] = process.argv;

30if (cmd === '--help' || cmd === '-h' || cmd === 'help' || !cmd) {

31 console.log('claude-collab-plugin — Claude Code integration for collab-mcp');

32 console.log('');

33 console.log('Usage: claude-collab-plugin <subcommand> [options]');

34 console.log('');

35 console.log('Subcommands:');

41 console.log(' claude-collab-plugin install');

42 console.log(' claude-collab-plugin doctor');

43 console.log(' claude-collab-plugin watch --interval 60');

44 console.log(' claude-collab-plugin session');

45 process.exit(cmd === 'help' ? 0 : 1);

46}

48if (cmd === 'version') {

49 const pkg = require('../package.json');

50 // Try `require` first (works when run from a project with the dep, or

51 // with NODE_PATH set). If that fails (typical for `npm install -g` —

52 // the cwd can't see the global package), fall back to spawning

53 // `collab-doctor --version`. We treat both as authoritative, not as

54 // a sign that the base is missing.

55 let baseVer = 'unknown';

56 let via = 'pending';

57 try {

58 baseVer = require('@trustbaseai/claude-collab/package.json').version;

59 via = 'require';

60 } catch (_) {

61 // Fallback: spawn `collab-doctor --version` (or scan its --json for version).

62 const { spawnSync } = require('child_process');

63 const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L61

64 encoding: 'utf8',

65 timeout: 10000,

66 windowsHide: true,

67 shell: true,

68 });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L66

69 if (r.status === 0 && r.stdout) {

70 try {

71 const j = JSON.parse(r.stdout);

72 const m = /(\d+\.\d+\.\d+)/.exec(JSON.stringify(j));

73 if (m) { baseVer = m[1]; via = 'collab-doctor --json'; }

74 } catch (_) {

75 const m = /v(\d+\.\d+\.\d+)/.exec(r.stdout);

76 if (m) { baseVer = m[1]; via = 'collab-doctor'; }

77 }

78 } else {

79 // Last-ditch: try to find the global install path

80 const { execSync } = require('child_process');

81 try {

82 const root = execSync('npm root -g', { encoding: 'utf8' }).trim();

83 const pkgPath = require('path').join(root, '@trustbaseai', 'claude-collab', 'package.json');

84 baseVer = require(pkgPath).version;

85 via = 'npm root -g';

86 } catch (_) { /* leave as unknown */ }

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg