Loading npm security reports…

@x402solana/clawd-bot@1.0.5: AI-agent control-surface risk | LPM Firewall

registry / @x402solana/clawd-bot / 1.0.5

@x402solana/clawd-bot@1.0.5

Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack, Skill Hub (train2earn + skillhub-main), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package runs a postinstall hook that places bundled skills into multiple AI-agent host directories. Those links can affect agents outside this package without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation with lifecycle scripts enabled

Impact

Broad AI-agent instruction and capability injection across Codex, Claude, and generic agent hosts

Mechanism

Copies skills and force-replaces symlinks in common agent skill directories

Policy narrative

The package's postinstall hook invokes its skill installer by default. That installer copies its bundled skills to a home-directory location, then runs a shell batch that force-replaces symlinks under three common AI-agent skill roots. Because this occurs during ordinary npm installation rather than an explicit user setup command, the package modifies broad, foreign agent control surfaces and can inject its instructions into those hosts.

Rationale

Source inspection confirms an automatic postinstall path that mutates ~/.agents, ~/.claude, and ~/.codex by linking package-provided skills. This meets the firewall policy for an unconsented install-time broad AI-agent control-surface mutation.

Evidence

package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjsscripts/pump-tape.mjs~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills

Network endpoints1

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

76"scripts": { "oneshot": "node scripts/oneshot-install.mjs", "install:stack": "node scripts/oneshot-install.mjs", "postinstall": "node scripts/postinstall.mjs", "skills:list": "node -e \"import('./scripts/sk[redacted]').then(m=>console.log(m.listSkillIds().join('\\n')))\""

High

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically on installation.

package.jsonView on unpkg · L76

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/oneshot-install.mjsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Write operation from scripts/oneshot-install.mjs: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Foreign user/project scop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/oneshot-install.mjsView on unpkg · L5

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

Source & flagged code

5 flagged

package.jsonView file

Lines 56-92json

56 "bin/clawdbot-go.js",

57 "bin/clawdbot-go.mjs",

58 "scripts/oneshot-install.mjs",

59 "scripts/skill-pack.mjs",

60 "scripts/postinstall.mjs",

61 "scripts/pump-tape.mjs",

62 "install-npm.sh",

63 "install.sh",

64 "skills",

65 "automaton-main/package.json",

66 "automaton-main/README.md",

67 "automaton-main/src",

68 "automaton-main/scripts",

69 "automaton-main/constitution.md",

70 "automaton-main/LICENSE",

71 "docs/RH_CRYPTO_AGENT_STACK.md",

72 "README.md",

73 "LICENSE",

74 "AGENTS.md"

75 ],

76 "scripts": {

77 "oneshot": "node scripts/oneshot-install.mjs",

78 "install:stack": "node scripts/oneshot-install.mjs",

79 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "skills:list": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

The npm postinstall hook runs automatically on installation.

package.jsonView on unpkg · L76

81 "skills:inspect": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(JSON.stringify(m.inspectPack(),null,2)))\"",

82 "test:oneshot": "node --test scripts/oneshot-install.test.mjs scripts/pump-tape.test.mjs",

83 "test:branding": "node --test scripts/branding-check.mjs",

84 "test:docs": "node --test scripts/docs-check.mjs",

85 "check": "node --check bin/clawdbot-go.mjs && node --check scripts/oneshot-install.mjs && node --check scripts/skill-pack.mjs && node --check scripts/postinstall.mjs && node --check scripts/pump-tape.mjs && npm run test:oneshot && npm run test:branding && npm run test:docs"

86 },

87 "preferGlobal": true,

88 "dependencies": {

89 "cheshire-terminal-agents": "^1.48.4"

90 }

91}

92

scripts/oneshot-install.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Clawd — one-shot stack installer (Grok Build style).

4 *

5 * Installs:

6 * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills

7 * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks

8 * • Optional: Go clawdbot binary, automaton-main deps, birth skill seeds

9 *

10 * Usage:

11

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg