registry / @visiq/openclaw-plugin / 0.1.5

@visiq/openclaw-plugin@0.1.5

OpenClaw plugin for VisIQ ALLOW + RECALL + RECORD

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 63.1 KB of source, external domains: api.visiqlabs.com

Source & flagged code

7 flagged

dist/chunk-2TT2F3AO.jsView file

Lines 1-9javascript

1import{readFile as ve}from"node:fs/promises";import{homedir as $}from"node:os";import{join as q,isAbsolute as Ae,resolve as we}from"node:path";import{createInterface as Ie}from"node:readline";import{parseArgs as ke}from"node:util";var B="@visiq/openclaw-plugin",Se='[VisIQ] OpenClaw plugin is installed but missing credentials. Provide them with one of (highest precedence first): (1) environment variables VISIQ_API_KEY=<key> VISIQ_AGENT_ID=<id> (set before `openclaw gateway run` / `openclaw start`) ; (2) a JSON file at the path in VISIQ_CONFIG_PATH ; (3) ~/.openclaw/openclaw.json -> plugins.entr ...

2`),null;let a={apiKey:i.apiKey,agentId:i.agentId};return i.baseUrl&&(a.baseUrl=i.baseUrl),a}var P=null,z={ready:!1,config:null};function h(){return P||(P=W().catch(e=>(process.stderr.write(`[VisIQ] Config resolution failed (treating as unconfigured): ${e instanceof Error?e.message:String(e)}

3`),null)).then(e=>(z={ready:!0,config:e},e))),P}function k(){return z}function Lt(){h()}import{z as o}from"zod";import*as m from"node:os";var K="interceptor_source",Oe=o.enum(["enforce","audit","off"]),Ne=o.enum(["closed","open"]),V=o.enum(["enforce","monitor","off"]),Pe=o.object({apiKey:o.string().min(1,"apiKey is required"),agentId:o.string().min(1,"agentId is required"),endpoint:o.string().url().optional(),mode:Oe.optional(),timeoutMs:o.number().int().positive().optional(),hitlTimeoutMs:o.number().int().positive().optional(),failBehavior:Ne.optional()}),jt=o.object({agent_id:o.string().min( ...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-2TT2F3AO.jsView on unpkg · L3

Critical

Secret Pattern

RSA private key in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

Medium

Secret Pattern

Hardcoded password in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

4MIIEv\u2026

5-----END PRIVATE KEY-----`,template:{pattern:f.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:f.jwt,mode:"full"},defaultEnabled:!0

6`);try{await l.text()}catch{}}finally{clearTimeout(a)}}catch(i){if(i instanceof Error&&i.name==="AbortError"){process.stderr.write(`[VisIQ] /v1/events POST timed out (5s)

7`);return}process.stderr.write(`[VisIQ] /v1/events POST error: ${i instanceof Error?i.message:String(i)}

8`)}}async function En(e,t){let n=await h();if(!n)return;let r=n.agentId??t.agentId;x(n,{type:"llm_input",agentId:r,sessionId:e.sessionId??t.sessionId??t.sessionKey,runId:e.runId??t.runId,timestamp:new Date().toISOString(),payload:{provider:e.provider,model:e.model,hasSystemPrompt:typeof e.systemPrompt=="string"&&e.systemPrompt.length>0,promptLength:typeof e.prompt=="string"?e.prompt.length:0,historyMessageCount:Array.isArray(e.historyMessages)?e.historyMessages.length:0,imagesCount:e.imagesCount??0,toolCount:Array.isArray(e.tools)?e.tools.length:0}})}function Ct(e){if(!Array.isArray(e))return ...

Long lines were clipped for display.

Source & flagged code

7 flagged · loading source

dist/chunk-2TT2F3AO.jsView file

3patternName = private_key_rsa severity = critical line = 3 matchedText = `),null)...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-2TT2F3AO.jsView on unpkg · L3

3patternName = private_key_rsa severity = critical line = 3 matchedText = `),null)...----

Critical

Secret Pattern

RSA private key in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

5patternName = stripe_live_secret severity = critical line = 5 matchedText = -----END...ext}

Critical

Secret Pattern

Stripe live secret key in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L5

5patternName = github_pat severity = critical line = 5 matchedText = -----END...ext}

Critical

Secret Pattern

GitHub personal access token in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L5

5patternName = aws_access_key severity = critical line = 5 matchedText = -----END...ext}

Critical

Secret Pattern

AWS access key ID in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L5

5patternName = google_api_key severity = high line = 5 matchedText = -----END...ext}

High

Secret Pattern

Google API key in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L5

3patternName = generic_password severity = medium line = 3 matchedText = `),null)...----

Medium

Secret Pattern

Hardcoded password in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

Findings

5 Critical1 High3 Medium2 Low

CriticalCritical Secretdist/chunk-2TT2F3AO.js

CriticalSecret Patterndist/chunk-2TT2F3AO.js

HighSecret Patterndist/chunk-2TT2F3AO.js

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/chunk-2TT2F3AO.js

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/chunk-2TT2F3AO.jsView file

Lines 1-9javascript

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/chunk-2TT2F3AO.jsView on unpkg · L3

Critical

Secret Pattern

RSA private key in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

Medium

Secret Pattern

Hardcoded password in dist/chunk-2TT2F3AO.js

dist/chunk-2TT2F3AO.jsView on unpkg · L3

4MIIEv\u2026

6`);try{await l.text()}catch{}}finally{clearTimeout(a)}}catch(i){if(i instanceof Error&&i.name==="AbortError"){process.stderr.write(`[VisIQ] /v1/events POST timed out (5s)

7`);return}process.stderr.write(`[VisIQ] /v1/events POST error: ${i instanceof Error?i.message:String(i)}

Long lines were clipped for display.