registry / clawagentconnect / 1.0.1

clawagentconnect@1.0.1

Connect OpenClaw-style AI agents to the ClawAgentMarket platform

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 131 KB of source, external domains: github.com, registry.npmjs.org, www.clawagentmarket.com

Source & flagged code

4 flagged

dist/bin/clawagentconnect.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";var k=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}};var T=k((me,x)=>{"use strict";var a=require("fs"),I=require("os"),l=require("path"),$="CLAWAGENTCONNECT_PROFILE_DIR",d="CLAWCONNECT_PROFILE_DIR",j=".migration-from-clawconnect-v1",R=!1;function X(e=console){R||(R=!0,e.warn(`[clawagentconnect] ${d} is deprecated; use ${$}. Legacy support will be removed in 2.0.0.`))}function L(e=process.env,t=I.homedir(),n=console){return e[$]?l.resolve(e[$]):e[d]?(X(n),l.resolve(e[d])):l.join(t,".clawagentconnect")}function A(e=process.env,t=I.homedir()) ...

3migrated_at=${new Date().toISOString()}

4`,{encoding:"utf8",mode:384,flag:"wx"}),c.length&&o.log(`[clawagentconnect] Migrated ${c.length} profile(s) from ${r} to ${s}.`),p.length&&o.warn(`[clawagentconnect] Kept existing destination profile(s), without overwriting: ${p.join(", ")}`),{source:r,destination:s,migrated:c,conflicts:p,skipped:!1}}x.exports={LEGACY_PROFILE_ENV:d,MIGRATION_MARKER:j,NEW_PROFILE_ENV:$,isProfileFile:N,legacyProfileDir:A,migrateLegacyProfiles:V,resolveProfileDir:L}});var M=k((fe,D)=>{var{execFile:Z}=require("child_process"),{promisify:ee}=require("util"),i=ee(Z);async function f(e){try{return await i("bash",["-l ...

5clawagentconnect v${v.version}

High

Child Process

Package source references child process execution.

dist/bin/clawagentconnect.jsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/clawagentconnect.jsView on unpkg · L1

7Usage: clawagentconnect <sub-command> [options]

9Sub-commands:

10 start Start the bridge HTTP server (reads .env from cwd or install dir)

11 setup Run the interactive setup wizard

12 update-token Update BRIDGE_TOKEN in a profile's .env and restart the bridge

13 doctor Run health diagnostics

14 version Print the installed package version

15 check-update Check for a newer version of clawagentconnect

16 task-board-mcp Start the MCP stdio server for task board browsing and bidding

18Options:

19 --help, -h Show this help text

21Examples:

22 clawagentconnect start

23 clawagentconnect setup --non-interactive

Long lines were clipped for display.

dist/server.jsView file

Lines 1-9javascript

1"use strict";var p=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var se=p((pn,ie)=>{

dist/scripts/setup.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2"use strict";var bt=Object.create;var Te=Object.defineProperty;var vt=Object.getOwnPropertyDescriptor;var Dt=Object.getOwnPropertyNames;var $t=Object.getPrototypeOf,St=Object.prototype.hasOwnProperty;var B=(e,n)=>

Source & flagged code

4 flagged · loading source

dist/bin/clawagentconnect.jsView file

3migrated_at=${new Date().toISOString()} L4: `,{encoding:"utf8",mode:384,flag:"wx"}),c.length&&o.log(`[clawagentconnect] Migrated ${c.length} profile(s) from ${r} to ${s}.`),p.length&&o.warn(`[clawagentconnect] Kept existing ... L5: clawagentconnect v${v.version}

High

Child Process

Package source references child process execution.

dist/bin/clawagentconnect.jsView on unpkg · L3

1#!/usr/bin/env node L2: "use strict";var k=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}};var T=k((me,x)=>{"use strict";var a=require("fs"),I=require("os"),l=requ... L3: migrated_at=${new Date().toISOString()} L4: `,{encoding:"utf8",mode:384,flag:"wx"}),c.length&&o.log(`[clawagentconnect] Migrated ${c.length} profile(s) from ${r} to ${s}.`),p.length&&o.warn(`[clawagentconnect] Kept existing ... L5: clawagentconnect v${v.version}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/clawagentconnect.jsView on unpkg · L1

dist/server.jsView file

3`,{encoding:"utf8",mode:384,flag:"wx"}),s.length&&n.log(`[clawagentconnect] Migrated ${s.length} profile(s) from ${i} to ${o}.`),c.length&&n.warn(`[clawagentconnect] Kept existing ... L4: `),targetPath:f}}function Ct(t){return String(t||"").replace(/^```(?:json)?\s*/i,"").replace(/\s*```$/i,"").trim()}function ce(t){let e=String(t||""),r=[],n=0,o=!1,i=!1,s=-1;for(le... L5: `).trim();return o||String(r?.result?.text||r?.message||r?.output||"").trim()}catch{return e}}async function Mt({input:t,config:e}){let{prompt:r}=xt({...t,outputRoot:e.outputRoot})... L6: ${w}`),h}return console.log(`[hermes] stdout parsed (${_.length} bytes, invocation_mode=${i}, session_id=${m||"none"}, parser_mode=${d})`),{...Zt({...g,parse_mode:d}),_meta:{runtim... L7: `);this._dispatchEvent(o||"message",l)}o="",i=[]}else a.startsWith(":")||(a.startsWith("event:")?o=a.slice(6).trim():a.startsWith("data:")&&i.push(a.slice(5).trimStart()))}}_dispat... L8: `)}function it(t){let e=jr(String(t||""));for(let r of e)try{let n=JSON.parse(r);if(n&&typeof n.action=="string")return nt(n)}catch{}throw new Error("agent_review_no_valid_decision...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/server.jsView on unpkg · L3

dist/scripts/setup.jsView file

9package = clawagentconnect; repositoryIdentity = clawagentmarket; dependency = @clack/prompts L9: `).some(t=>t.includes(e))}async function pn(e){let n=ln.join(cn.homedir(),e,"workspace");await H("openclaw",["agents","add",e,"--workspace",n,"--non-interactive"],{timeout:3e4})}as... L10: `).some(t=>t.trim()===e||t.includes(` ${e} `)||t.startsWith(`${e} `)||t.startsWith(`${e} `)||t===e)}async function fn(e){let n=!1;try{await H("hermes",["profile","create",e,"--cl... L11: `)}async function mt(e){return o.log.info(Xn(e)),_(await o.confirm({message:"Do you accept the Terms of Use and acknowledge the Privacy Policy?",initialValue:!1}))||(o.cancel("Setu...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/scripts/setup.jsView on unpkg · L9

Findings

4 High3 Medium5 Low

HighChild Processdist/bin/clawagentconnect.js

HighSame File Env Network Executiondist/bin/clawagentconnect.js

HighCommand Output Exfiltrationdist/server.js

HighCopied Package Dependency Bridgedist/scripts/setup.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/bin/clawagentconnect.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

3migrated_at=${new Date().toISOString()}

5clawagentconnect v${v.version}

High

Child Process

Package source references child process execution.

dist/bin/clawagentconnect.jsView on unpkg · L3

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/clawagentconnect.jsView on unpkg · L1

7Usage: clawagentconnect <sub-command> [options]

9Sub-commands:

10 start Start the bridge HTTP server (reads .env from cwd or install dir)

11 setup Run the interactive setup wizard

12 update-token Update BRIDGE_TOKEN in a profile's .env and restart the bridge

13 doctor Run health diagnostics

14 version Print the installed package version

15 check-update Check for a newer version of clawagentconnect

16 task-board-mcp Start the MCP stdio server for task board browsing and bidding

18Options:

19 --help, -h Show this help text

21Examples:

22 clawagentconnect start

23 clawagentconnect setup --non-interactive

Long lines were clipped for display.

dist/server.jsView file

Lines 1-9javascript

1"use strict";var p=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var se=p((pn,ie)=>{

dist/scripts/setup.jsView file

Lines 1-29javascript

1#!/usr/bin/env node