@vaibot/circuit-breaker-openclaw-plugin@1.3.2
OpenClaw plugin that enforces VAIBot governance decisions with a multi-source decision chain and circuit-breaker fallback.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe automatic postinstall hook makes broad changes to the consumer’s OpenClaw plugin configuration and enables the package. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
Installing the package through npm runs its postinstall hook, unless the OpenClaw native installer environment flag is set.
Impact
Installation changes the consumer’s agent configuration, including entries belonging to other plugins, and activates this plugin.
Mechanism
The script copies the package into the extensions directory, edits the existing configuration, removes path properties across plugin entries, enables this plugin, and writes the result.
Policy narrative
During npm installation, the package’s postinstall hook writes to OpenClaw’s configuration. It removes path settings across plugin entries and enables this plugin, changing the consumer’s agent control configuration without a separate user confirmation.
AI rationale
The automatic postinstall hook makes broad changes to the consumer’s OpenClaw plugin configuration and enables the package. This meets the policy for blocking unconsented install-time mutation of an AI-agent control surface.
Evidence
package.jsonscripts/postinstall.mjs~/.openclaw/openclaw.json~/.openclaw/extensions/circuit-breaker-openclaw-plugin/
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs scripts/postinstall.mjs from its postinstall lifecycle hook.
- The installer removes path settings from every plugin entry in the OpenClaw configuration.
- It then enables this plugin and writes the modified configuration.
- The installer copies the package into OpenClaw’s extensions directory.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
10 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node ./scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node ./scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/verify-pack.mjsView file
1#!/usr/bin/env node
L2: import { execFileSync } from 'node:child_process'
L3:
High
Child Process
Package source references child process execution.
scripts/verify-pack.mjsView on unpkg · L1Findings
2 Critical7 High4 Medium4 Low
CriticalSame File Env Network Executionvendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1
CriticalAi Agent Control Hijackscripts/postinstall.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processscripts/verify-pack.mjs
HighSemantic Analysis Limitedvendor/vaibot-guard/scripts/vaibot-guard.mjs#virtual:normalized:round1
HighKnown Malware Source Similarityvendor/vaibot-guard/scripts/vaibot-guard.mjs
HighKnown Malware Source Similarityvendor/vaibot-guard/scripts/vaibot-guard-exec.mjs
HighKnown Malware Source Similarityvendor/vaibot-guard/scripts/lib/guard-launch.mjs
HighPrevious Version Dangerous Deltavendor/vaibot-guard/scripts/vaibot-guard.mjs
Affected versions and remediation
This report applies to @vaibot/circuit-breaker-openclaw-plugin@1.3.2.
See all versions of @vaibot/circuit-breaker-openclaw-plugin for other recorded verdicts.
- Avoid installing @vaibot/circuit-breaker-openclaw-plugin@1.3.2. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.