registry / AI-agent control-surface risk / @x402solana/clawd-bot

@x402solana/clawd-bot

Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack, Skill Hub (train2earn + skillhub-main), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd

This report shows the evidence for @x402solana/clawd-bot@1.0.6. 2 of 2 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The package performs unconsented postinstall mutation of broad, foreign AI-agent skill directories. This meets the firewall block rule even though no credential theft was found.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install, through the postinstall lifecycle hook.

Impact

A package installation can inject package-controlled instructions and capabilities into existing AI-agent environments.

Mechanism

Copies bundled skills and creates forced symlinks in AI-agent skill directories.

Policy narrative

During npm installation, the postinstall hook imports the installer and installs its skill pack by default. The installer copies skills into the user's Clawd directory, creates missing generic, Claude, and Codex skill directories, and force-replaces symlinks there. These foreign AI-agent control surfaces are modified without a user-invoked setup command.

AI rationale

The package performs unconsented postinstall mutation of broad, foreign AI-agent skill directories. This meets the firewall block rule even though no credential theft was found.

Evidence

package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjsscripts/pump-tape.mjs~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills

Network endpoints1

wss://clawd-ws.fly.dev/ws

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 99.0% confidence with low false-positive risk.

Evidence for policy risk

The package declares a postinstall lifecycle hook.
Postinstall runs the skill installer by default unless an environment variable disables it.
That installer copies bundled skills and symlinks them into the user's Claude, Codex, and generic agent skill directories without consent.

Evidence against

No source code read or transmits local credentials or files.
The observed WebSocket connection is a bounded, TTY-only display feature, not credential exfiltration.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 48.3 KB of source, external domains: cheshireterminal.ai, clawdrouter-zk.fly.dev, funpump.ai, github.com, raw.githubusercontent.com, solgpt.us, www.npmjs.com

Source & flagged code

5 flagged

package.jsonView file

Lines 56-92json

56 "bin/clawdbot-go.js",

57 "bin/clawdbot-go.mjs",

58 "scripts/oneshot-install.mjs",

59 "scripts/skill-pack.mjs",

60 "scripts/postinstall.mjs",

61 "scripts/pump-tape.mjs",

62 "install-npm.sh",

63 "install.sh",

64 "skills",

65 "automaton-main/package.json",

66 "automaton-main/README.md",

67 "automaton-main/src",

68 "automaton-main/scripts",

69 "automaton-main/constitution.md",

70 "automaton-main/LICENSE",

71 "docs/RH_CRYPTO_AGENT_STACK.md",

72 "README.md",

73 "LICENSE",

74 "AGENTS.md"

75 ],

76 "scripts": {

77 "oneshot": "node scripts/oneshot-install.mjs",

78 "install:stack": "node scripts/oneshot-install.mjs",

79 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "skills:list": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

The package declares a postinstall lifecycle hook.

package.jsonView on unpkg · L76

81 "skills:inspect": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(JSON.stringify(m.inspectPack(),null,2)))\"",

82 "test:oneshot": "node --test scripts/oneshot-install.test.mjs scripts/pump-tape.test.mjs",

83 "test:branding": "node --test scripts/branding-check.mjs",

84 "test:docs": "node --test scripts/docs-check.mjs",

85 "check": "node --check bin/clawdbot-go.mjs && node --check scripts/oneshot-install.mjs && node --check scripts/skill-pack.mjs && node --check scripts/postinstall.mjs && node --check scripts/pump-tape.mjs && npm run test:oneshot && npm run test:branding && npm run test:docs"

86 },

87 "preferGlobal": true,

88 "dependencies": {

89 "cheshire-terminal-agents": "^1.48.4"

90 }

91}

scripts/oneshot-install.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Clawd — one-shot stack installer (Grok Build style).

4 *

5 * Installs:

6 * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills

7 * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks

8 * • Optional: Go clawdbot binary, automaton-main deps, birth skill seeds

9 *

10 * Usage:

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

76"scripts": { "oneshot": "node scripts/oneshot-install.mjs", "install:stack": "node scripts/oneshot-install.mjs", "postinstall": "node scripts/postinstall.mjs", "skills:list": "node -e \"import('./scripts/sk[redacted]').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

The package declares a postinstall lifecycle hook.

package.jsonView on unpkg · L76

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/oneshot-install.mjs

Findings

1 Critical2 High5 Medium4 Low

CriticalAi Agent Control Hijackscripts/oneshot-install.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall-npm.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @x402solana/clawd-bot@1.0.6.

The versions list below shows the verdict for each recorded version.

Avoid installing @x402solana/clawd-bot@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-26 19:29:34.429Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

1.0.6latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 26, 2026, 7:19 PM 1.0.5MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 26, 2026, 7:16 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Runtime surface

Behavioral surface

Source & flagged code

Related packages

Other AI-agent control-surface risk packages