registry / @trustbaseai/claude-collab-plugin / 0.8.1

@trustbaseai/claude-collab-plugin@0.8.1

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs the install command and enables `claude-collab-plugin watch --auto-wake` or saved auto-wake configuration.

Impact

A malicious collaboration message could attempt to steer the unattended Claude subprocess into executing local commands; tool summaries may be forwarded through the collaboration client.

Mechanism

remote-message-to-agent prompt injection with dangerous Bash capability

Rationale

This is not an npm lifecycle attack and its control-surface changes are explicit-user-command setup. However, the opt-in auto-wake path combines remotely sourced content with an unattended agent process whose Bash permissions are deliberately bypassed.

Evidence

src/settings.jssrc/hooks.jsbin/claude-collab-plugin-watch.jsscripts/claude-auto-wake.jsscripts/claude-posttool-hook.jspackage.json~/.claude/settings.jsonD:/myopenclaw/.tmp/claude-pending-baobei.json

Decision evidence

public snapshot

AI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

scripts/claude-auto-wake.js passes remote pending messages to `claude --print` with `--allow-dangerously-skip-permissions` and Bash allowed.
bin/claude-collab-plugin-watch.js invokes auto-wake when explicitly enabled, after `collab-read` retrieves messages.
src/settings.js installs persistent PostToolUse, SessionStart, and UserPromptSubmit command hooks in `~/.claude/settings.json`.
scripts/claude-posttool-hook.js forwards summaries of write operations and non-read Bash commands through `collab-send`.

Evidence against

package.json contains no preinstall, install, or postinstall lifecycle hook.
Hook/config mutations occur only through the package's explicit install command and are marker-scoped with backups.
No source-level HTTP client, credential harvesting, eval/vm use, payload download, or destructive broad file operation was found.
Auto-wake is opt-in by CLI flag or saved package configuration rather than enabled at import/install time.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 78.5 KB of source

Source & flagged code

5 flagged

bin/claude-collab-plugin.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * claude-collab-plugin — Claude Code integration layer for collab-mcp

4 *

5 * Subcommands:

6 * install Register the PostToolUse hook in ~/.claude/settings.json

7 * uninstall Remove the PostToolUse hook

8 * doctor Claude Code specific health check

9 * watch Local health-watch daemon (no collab-mcp traffic)

10 * wake-once Trigger one immediate poll + auto-wake cycle

11 * clear-pending Delete the pending file (force fresh start)

12 * status Print watch daemon state (PID, interval, lastSeenId, ...)

13 * config Get / set / reset persistent watch settings

14 * session Print most recent Claude Code session state

15 * version Print plugin + base version

16 * help Help

17 */

18'use strict';

20const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L19

22const subcommands = {

23 install: { file: 'claude-collab-plugin-install.js', desc: 'Register PostToolUse hook in settings.json' },

24 uninstall: { file: 'claude-collab-plugin-uninstall.js', desc: 'Remove PostToolUse hook' },

25 doctor: { file: 'claude-collab-plugin-doctor.js', desc: 'Claude Code health check' },

26 watch: { file: 'claude-collab-plugin-watch.js', desc: 'Local health-watch daemon' },

27 'wake-once': { file: 'claude-collab-plugin-wake-once.js', desc: 'Trigger one poll + auto-wake cycle' },

28 'clear-pending': { file: 'claude-collab-plugin-clear-pending.js', desc: 'Delete the pending file' },

29 status: { file: 'claude-collab-plugin-status.js', desc: 'Print watch daemon state' },

30 config: { file: 'claude-collab-plugin-config.js', desc: 'Get / set / reset persistent watch settings' },

31 session: { file: 'claude-collab-plugin-session.js', desc: 'Print recent session state' },

32 version: { desc: 'Print plugin + base version' },

33 help: { desc: 'Help' },

34};

36const [, , rawCmd, ...rest] = process.argv;

37// On Windows + MSYS, the positional subcommand sometimes arrives as

38// "config" (literally with quotes). Strip outer single/double quotes

39// so subcommand lookup works regardless of how the shell quoted it.

Lines 48-93javascript

48 for (const [name, meta] of Object.entries(subcommands)) {

49 console.log(` ${name.padEnd(13)} ${meta.desc}`);

50 }

51 console.log('');

52 console.log(

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

67 if (!s.sessionStartExists) {

bin/claude-collab-plugin-watch.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/claude-collab-plugin@0.5.1 matchedIdentity = npm:[redacted]:0.5.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/claude-collab-plugin.jsView file

68} catch (_) { L69: const { spawnSync } = require('child_process'); L70: const r = spawnSync('collab-doctor --json', [], {

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin.jsView on unpkg · L68

73windowsHide: true, L74: shell: true, L75: });

High

Shell

Package source references shell execution.

bin/claude-collab-plugin.jsView on unpkg · L73

19L20: const path = require('path'); L21:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin.jsView on unpkg · L19

src/plugin-doctor.jsView file

81// require() resolution issue (cwd can't see packages installed via L82: // `npm install -g`). On Windows we need `shell: true` so the shell L83: // resolves `collab-doctor` to `collab-doctor.cmd` (PATHEXT).

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/plugin-doctor.jsView on unpkg · L81

bin/claude-collab-plugin-watch.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/claude-collab-plugin-watch.jsView on unpkg

Findings

1 Critical3 High3 Medium3 Low

CriticalPrevious Version Dangerous Deltabin/claude-collab-plugin-watch.js

HighChild Processbin/claude-collab-plugin.js

HighShellbin/claude-collab-plugin.js

HighRuntime Package Installsrc/plugin-doctor.js

MediumDynamic Requirebin/claude-collab-plugin.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

93%Warn

Verdict confidence

IntentDangerous Capability

TypeAI-agent capability abuse

False-positive riskMedium

Review stagesource_first_review

Firewall policyWarn-only AI-agent capability risk

Package metadata

npm

Authoroxiaom

Maintainersoxiaom

Version0.10.0

PublishedJul 16, 2026

LicenseMIT

Dependencies1

Integrityverified

Package size28.5 KB

Files30

Keywordsclaude-codeclaude-collabpluginhookssettings.jsonmcpmulti-agent

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → src/index.jsbin → claude-collab-plugin, claude-collab-plugin-doctor, claude-collab-plugin-install +3

Runtimenode >=18

Artifact97.5 KB · 30 files1 signature(s)

Install lifecycleNo install hooks · other: check, doctor, test

Behavioral surface

ChildProcessDynamicRequireEnvironmentVarsFilesystemShellHighEntropyStringsManifest: clean