registry / @trustbaseai/openclaw-collab / 0.2.2

@trustbaseai/openclaw-collab@0.2.2

OpenClaw plugin: bridges @trustbaseai/collab-mcp into 8 typed tools + auto-wake loop. Safe hooks only (session_start/end, gateway_stop).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 131 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/src/config.mjsView file

Lines 1-37javascript

1// HTTP client for collab-mcp (running on localhost:3010).

2// Talks to the same JSON API the web dashboard uses.

4/**

5 * @typedef {Object} CollabConfig

6 * @property {string} baseUrl

7 * @property {string} username

8 * @property {string} password

9 * @property {number} pollIntervalSec

10 * @property {number} unackedThreshold

11 */

13/** @type {CollabConfig} */

14export const DEFAULT_CONFIG = {

15 baseUrl: 'http://127.0.0.1:3010',

16 username: 'admin',

17 password: 'admin123',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/config.mjsView on unpkg · L17

18 botName: 'baobei', // default; set COLLAB_BOT_NAME or pluginConfig.botName to override

19 // Default session key is the gateway's main session. Override in

20 // openclaw.json plugins.entries.collab.config.sessionKey if you want

21 // wake replies to land in your dashboard's 【主要会话】 instead.

22 // Common values:

23 // - "agent:main:main" — gateway main

24 // - "agent:main:baobei-webchat-main" — webchat dashboard

25 sessionKey: 'agent:main:main',

26 pollIntervalSec: 30,

27 unackedThreshold: 1,

28 OPENCLAW_NODE: '',

29 OPENCLAW_MJS: '',

30 // The label to look up in `openclaw sessions list --json` when

31 // resolving the full dashboard session key dynamically. The full

32 // dashboard key (e.g. agent:main:dashboard:b33ead72-...) changes on

33 // every gateway restart or session recreation, so we look it up by

34 // label. xiaom's webchat dashboard session is labelled

35 // "baobei-webchat-main" — change this if you rename the dashboard

36 // session label.

37 dashboardLabel: 'baobei-webchat-main',

src/listener.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @trustbaseai/openclaw-collab@0.2.0 matchedIdentity = npm:[redacted]:0.2.0 similarity = 1.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/listener.jsView on unpkg

src/config.mjsView file

Lines 1-37javascript

1// HTTP client for collab-mcp (running on localhost:3010).

2// Talks to the same JSON API the web dashboard uses.

4/**

5 * @typedef {Object} CollabConfig

6 * @property {string} baseUrl

7 * @property {string} username

8 * @property {string}

Source & flagged code

3 flagged · loading source

dist/src/config.mjsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...23',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/config.mjsView on unpkg · L17

src/listener.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/listener.jsView on unpkg

src/config.mjsView file

17patternName = generic_password severity = medium line = 17 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L17

Findings

1 High4 Medium4 Low

HighPrevious Version Dangerous Deltasrc/listener.js

MediumSecret Patterndist/src/config.mjs

MediumNetwork

MediumEnvironment Vars

MediumSecret Patternsrc/config.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/src/config.mjsView file

Lines 1-37javascript

1// HTTP client for collab-mcp (running on localhost:3010).

2// Talks to the same JSON API the web dashboard uses.

4/**

5 * @typedef {Object} CollabConfig

6 * @property {string} baseUrl

7 * @property {string} username

8 * @property {string} password

9 * @property {number} pollIntervalSec

10 * @property {number} unackedThreshold

11 */

13/** @type {CollabConfig} */

14export const DEFAULT_CONFIG = {

15 baseUrl: 'http://127.0.0.1:3010',

16 username: 'admin',

17 password: 'admin123',

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/src/config.mjsView on unpkg · L17

18 botName: 'baobei', // default; set COLLAB_BOT_NAME or pluginConfig.botName to override

19 // Default session key is the gateway's main session. Override in

20 // openclaw.json plugins.entries.collab.config.sessionKey if you want

21 // wake replies to land in your dashboard's 【主要会话】 instead.

22 // Common values:

23 // - "agent:main:main" — gateway main

24 // - "agent:main:baobei-webchat-main" — webchat dashboard

25 sessionKey: 'agent:main:main',

26 pollIntervalSec: 30,

27 unackedThreshold: 1,

28 OPENCLAW_NODE: '',

29 OPENCLAW_MJS: '',

30 // The label to look up in `openclaw sessions list --json` when

31 // resolving the full dashboard session key dynamically. The full

32 // dashboard key (e.g. agent:main:dashboard:b33ead72-...) changes on

33 // every gateway restart or session recreation, so we look it up by

34 // label. xiaom's webchat dashboard session is labelled

35 // "baobei-webchat-main" — change this if you rename the dashboard

36 // session label.

37 dashboardLabel: 'baobei-webchat-main',

src/listener.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/listener.jsView on unpkg

src/config.mjsView file

Lines 1-37javascript

1// HTTP client for collab-mcp (running on localhost:3010).

2// Talks to the same JSON API the web dashboard uses.

4/**

5 * @typedef {Object} CollabConfig

6 * @property {string} baseUrl

7 * @property {string} username

8 * @property {string}