registry / clawagentconnect / 1.0.1

clawagentconnect@1.0.1

Connect OpenClaw-style AI agents to the ClawAgentMarket platform

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 6 file(s), 131 KB of source, external domains: github.com, registry.npmjs.org, www.clawagentmarket.com

Source & flagged code

4 flagged

dist/bin/clawagentconnect.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";var k=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}};var

Source & flagged code

4 flagged · loading source

dist/bin/clawagentconnect.jsView file

3migrated_at=${new Date().toISOString()} L4: `,{encoding:"utf8",mode:384,flag:"wx"}),c.length&&o.log(`[clawagentconnect] Migrated ${c.length} profile(s) from ${r} to ${s}.`),p.length&&o.warn(`[clawagentconnect] Kept existing ... L5: clawagentconnect v${v.version}

High

Child Process

Package source references child process execution.

dist/bin/clawagentconnect.jsView on unpkg · L3

1#!/usr/bin/env node L2: "use strict";var k=(e,t)=>()=>{try{return t||e((t={exports:{}}).exports,t),t.exports}catch(n){throw t=0,n}};var T=k((me,x)=>{"use strict";var a=require("fs"),I=require("os"),l=requ... L3: migrated_at=${new Date().toISOString()} L4: `,{encoding:"utf8",mode:384,flag:"wx"}),c.length&&o.log(`[clawagentconnect] Migrated ${c.length} profile(s) from ${r} to ${s}.`),p.length&&o.warn(`[clawagentconnect] Kept existing ... L5: clawagentconnect v${v.version}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/bin/clawagentconnect.jsView on unpkg · L1

dist/server.jsView file

3`,{encoding:"utf8",mode:384,flag:"wx"}),s.length&&n.log(`[clawagentconnect] Migrated ${s.length} profile(s) from ${i} to ${o}.`),c.length&&n.warn(`[clawagentconnect] Kept existing ... L4: `),targetPath:f}}function Ct(t){return String(t||"").replace(/^```(?:json)?\s*/i,"").replace(/\s*```$/i,"").trim()}function ce(t){let e=String(t||""),r=[],n=0,o=!1,i=!1,s=-1;for(le... L5: `).trim();return o||String(r?.result?.text||r?.message||r?.output||"").trim()}catch{return e}}async function Mt({input:t,config:e}){let{prompt:r}=xt({...t,outputRoot:e.outputRoot})... L6: ${w}`),h}return console.log(`[hermes] stdout parsed (${_.length} bytes, invocation_mode=${i}, session_id=${m||"none"}, parser_mode=${d})`),{...Zt({...g,parse_mode:d}),_meta:{runtim... L7: `);this._dispatchEvent(o||"message",l)}o="",i=[]}else a.startsWith(":")||(a.startsWith("event:")?o=a.slice(6).trim():a.startsWith("data:")&&i.push(a.slice(5).trimStart()))}}_dispat... L8: `)}function it(t){let e=jr(String(t||""));for(let r of e)try{let n=JSON.parse(r);if(n&&typeof n.action=="string")return nt(n)}catch{}throw new Error("agent_review_no_valid_decision...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/server.jsView on unpkg · L3

dist/scripts/setup.jsView file

9package = clawagentconnect; repositoryIdentity = clawagentmarket; dependency = @clack/prompts L9: `).some(t=>t.includes(e))}async function pn(e){let n=ln.join(cn.homedir(),e,"workspace");await H("openclaw",["agents","add",e,"--workspace",n,"--non-interactive"],{timeout:3e4})}as... L10: `).some(t=>t.trim()===e||t.includes(` ${e} `)||t.startsWith(`${e} `)||t.startsWith(`${e} `)||t===e)}async function fn(e){let n=!1;try{await H("hermes",["profile","create",e,"--cl... L11: `)}async function mt(e){return o.log.info(Xn(e)),_(await o.confirm({message:"Do you accept the Terms of Use and acknowledge the Privacy Policy?",initialValue:!1}))||(o.cancel("Setu...

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/scripts/setup.jsView on unpkg · L9

Findings

4 High3 Medium5 Low

HighChild Processdist/bin/clawagentconnect.js

HighSame File Env Network Executiondist/bin/clawagentconnect.js

HighCommand Output Exfiltrationdist/server.js

HighCopied Package Dependency Bridgedist/scripts/setup.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

dist/server.jsView file

Lines 1-9javascript

1"use strict";var p=(t,e)=>()=>{try{return e||t((e={exports:{}}).exports,e),e.exports}catch(r){throw e=0,r}};var se=p((pn,ie)=>{"use strict";var T=require("fs"),P=require("os"),v=require("path"),x="CLAWAGENTCONNECT_PROFILE_DIR",R="CLAWCONNECT_PROFILE_DIR",te=".migration-from-clawconnect-v1",ee=!1;function vt(t=console){ee||(ee=!0,t.warn(`[clawagentconnect] ${R} is deprecated; use ${x}. Legacy support will be removed in 2.0.0.`))}function re(t=process.env,e=P.homedir(),r=console){return t[x]?v.resolve(t[x]):t[R]?(vt(r),v.resolve(t[R])):v.join(e,".clawagentconnect")}function ne(t=process.env,e=P. ...

2migrated_at=${new Date().toISOString()}

3`,{encoding:"utf8",mode:384,flag:"wx"}),s.length&&n.log(`[clawagentconnect] Migrated ${s.length} profile(s) from ${i} to ${o}.`),c.length&&n.warn(`[clawagentconnect] Kept existing destination profile(s), without overwriting: ${c.join(", ")}`),{source:i,destination:o,migrated:s,conflicts:c,skipped:!1}}ie.exports={LEGACY_PROFILE_ENV:R,MIGRATION_MARKER:te,NEW_PROFILE_ENV:x,isProfileFile:oe,legacyProfileDir:ne,migrateLegacyProfiles:bt,resolveProfileDir:re}});var A=p((fn,le)=>{var Rt=require("path");function Ot(t,e){let r=`order-${String(e||"").slice(0,12)

4`),targetPath:f}}function Ct(t){return String(t||"").replace(/^```(?:json)?\s*/i,"").replace(/\s*```$/i,"").trim()}function ce(t){let e

5`).trim();return o||String(r?.result?.text||r?.message||r?.output||"").trim()}catch{return e}}async function Mt({input:t,config:e}){let{prompt:r}=xt({...t,outputRoot:e.outputRoot}),n=Dt(t.session_key||`order:${t.order_id}:v1`,t.order_id),o=e.timeoutSec,i=String(e.agentId||"").trim();if(!i)throw new Error("missing_bridge_agent_id_for_openclaw");let s=["agent","--agent",i,"--session-id",n,"--message",r,"--json","--timeout",String(o)],c=Date.now(),{stdout:a}=await ue("openclaw",s,{timeout:Number(o)*1e3+5e3,maxBuffer:20*1024*1024}),l=de(a),{parsed:u,mode:_}=Pt(l);return{...Bt({...u,parse_mode:_}), ...

6${w}`),h}return console.log(`[hermes] stdout parsed (${_.length} bytes, invocation_mode=${i}, session_id=${m||"none"}, parser_mode=${d})`),{...Zt({...g,parse_mode:d}),_meta:{runtime_backend:"hermes",invocation_mode:i,hermes_session_id:m,parser_mode:d,timeout_sec:a,duration_ms:Date.now()-l,command:Xt({agentId:o,mode:i})}}}async function er({prompt:t,config:e}){let r

7`);this._dispatchEvent(o||"message",l)}o="",i=[]}else a.startsWith(":")||(a.startsWith("event:")?o=a.slice(6).trim():a.startsWith("data:")&&i.push(a.slice(5).trimStart()))}}_dispatchEvent(e,r){if(e==="order"){let n;try{n=JSON.parse(r)}catch{return}if(!n?.order_id||this._activeOrders.has(n.order_id))return;this._activeOrders.add(n.order_id);let o=setTimeout(()=>{this._activeOrders.has(n.order_id)&&(console.warn(`[POLLER] Order lease expired for ${n.order_id} after ${this._orderLeaseTimeoutMs}ms \u2014 forcing removal`),this._activeOrders.delete(n.order_id))},this._orderLeaseTimeoutMs);this._han ...

8`)}function it(t){let e=jr(String(t||""));for(let r of e)try{let n=JSON.parse(r);if(n&&typeof n.action=="string")return nt(n)}catch{}throw new Error(

Long lines were clipped for display.

dist/scripts/setup.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2"use strict";var bt=Object.create;var Te=Object.defineProperty;var vt=Object.getOwnPropertyDescriptor;var Dt=Object.getOwnPropertyNames;var $t=Object.getPrototypeOf,St=Object.prototype.hasOwnProperty;var B=(e,n)=>()=>{try{return n||e((n={exports:{}}).exports,n),n.exports}catch(t){throw n=0,t}};var Ct=(e,n,t,r)=>{if(n&&typeof n=="object"||typeof n=="function")for(let a of Dt(n))!St.call(e,a)&&a!==t&&Te(e,a,{get:()=>n[a],enumerable:!(r=vt(n,a))||r.enumerable});return e};var Bt=(e,n,t)=>(t=e!=null?bt($t(e)):{},Ct(n||!e||!e.__esModule?Te(t,"default",{value:e,enumerable:!0}):t,e));var le=B((or,Gt)= ...

3`).replace(/\n{3,}/g,`

5`);Z.writeFileSync(c,`${T}

6`,"utf8");try{Z.chmodSync(c,384)}catch{}return{envPath:c,backupPath:f?d:null}}Fe.exports={MANAGED_KEYS:ae,writeEnv:Yt,parseEnv:je}});var He=B((gr,Ve)=>{var{execFile:Jt}=require("child_process"),{promisify:Zt}=require("util"),M=Zt(Jt);async function Q(e){try{return await M("bash",["-lc",`command -v ${e}`],{timeout:5e3}),!0}catch{return!1}}function X(e,n=!1){let t=String(e||"").trim().toLowerCase()||"default",r=n?"clawconnect":"clawagentconnect";return t==="default"?r:`${r}-${t}`}async function Xt(){if(!await Q("pm2"))return[];try{let{stdout:e}=await M("bash",["-lc","pm2 jlist"],{timeout:1e4});r ...

7migrated_at=${new Date().toISOString()}

8`,{encoding:"utf8",mode:384,flag:"wx"}),d.length&&r.log(`[clawagentconnect] Migrated ${d.length} profile(s) from ${c} to ${a}.`),f.length&&r.warn(`[clawagentconnect] Kept existing destination profile(s), without overwriting: ${f.join(", ")}`),{source:c,destination:a,migrated:d,conflicts:f,skipped:!1}}et.exports={LEGACY_PROFILE_ENV:V,MIGRATION_MARKER:Je,NEW_PROFILE_ENV:se,isProfileFile:Qe,legacyProfileDir:Xe,migrateLegacyProfiles:on,resolveProfileDir:Ze}});var rt=B

9`).some(t=>t.includes(e))}async function pn(e){let n=ln.join(cn.homedir(),e,"workspace");await H("openclaw",["agents","add",e,"--workspace",n,"--non-interactive"],{timeout:3e4})}async function mn(e){let{stdout:n}=await H("hermes",["profile","list"],{timeout:1e4});return String(n||"").split(`

10`).some(t=>t.trim()===e||t.includes(` ${e} `)||t.startsWith(`${e} `)||t.startsWith(`${e} `)||t===e)}async function fn(e){let n=!1;try{await H("hermes",["profile","create",e,"--clone"],{timeout:3e4}),n=!0}catch{await H("hermes",["profile","create",e],{timeout:3e4})}return{modelConfigured:n}}nt.exports={checkCommand:un,checkHealth:dn,openClawAgentExists:gn,createOpenClawAgent:pn,hermesProfileExists:mn,createHermesProfile:fn}});var st=B((fr,at)=>{var{validateEmail:fe}=ue(),ot="2026-05-11";function Ee(){return{terms_accepted:!0,privacy_acknowledged:!0,legal_version:ot,accepted_at:new Date().toIS ...

11`)}async function mt(e){return o.log.info(Xn(e)),_(await o.confirm({message:"Do you accept the Terms of Use and acknowledge the Privacy Policy?",initialValue:!1}))||(o.cancel("Setup cancelled. Legal acknowledgement is required to continue."),process.exit(0)),wt()}async function Qn(e,n){o.log.

12 Continuing will update this profile's configuration.`),_(await o.confirm({message:"Continue and update this profile?",initialValue:!1}))||(o.cancel("Setup cancelled."),process.exit(0))}let d=_(await o.select({message:"Runtime backend",options:ft,initialValue:t.BRIDGE_RUNTIME_BACKEND}));t.BRIDGE_RUNTIME_BACKEND=d;let f=_(await o.text({message:"Output root directory",initialValue:t.OUTPUT_ROOT,placeholder:t.OUTPUT_ROOT,validate:m=>{if(!m.trim())return"Path cannot be empty."}}));if(t.OUTPUT_ROOT=f.trim(),t.BRIDGE_RUNTIME_BACKEND==="openclaw"){let m=o.spinner();m.start(`Checking openclaw for age ...

13 Run: hermes model --profile ${t.BRIDGE_AGENT_ID}

14 then choose your provider and model before placing orders.`))}catch(y){I.stop(`Failed to create hermes profile: ${y.message}`,1),o.log.warn("Continuing without creating the profile. You can create it manually later with: hermes profile create "+t.BRIDGE_AGENT_ID)}}}}let g=t.BRIDGE_RUNTIME_BACKEND==="hermes"?Math.max(Number(t.BRIDGE_RUNTIME_TIMEOUT_SEC)||0,600):Number(t.BRIDGE_RUNTIME_TIMEOUT_SEC)||240,h=_(await o.text({message:"Execution timeout in seconds (BRIDGE_RUNTIME_TIMEOUT_SEC)",initialValue:String(g),validate:m=>{let w=Number(m);if(!Number.isFinite(w)||w<=0)return"Must be a positive ...

15`),console.log("Pre-checks:"),console.log(`- node: ${d.ok?d.output:"missing"}`),console.log(`- npm: ${f.ok?f.output:"missing"}`),console.log(`- openclaw: ${g.ok?g.output:"missing"}`),console.log(`- zeroclaw: ${h.

16Registered profiles:`);for(let s of c)console.log(` ${s.profile.padEnd(20)} agent: ${s.agentId.padEnd(24)} backend: ${s.backend.padEnd(12)} [${s.status}]`)}}else if(o.log.info(`node ${d.

17Pass it explicitly with --bridge-token <value>, or run setup interactively to rotate it.`),process.exit(3)),o.log.warn("Your connection key is stored as a hash and the plaintext is no longer available."),_(await o.select({message:"How would you like to proceed?",options:[{value:"manual",label:"Enter my existing key manually",hint:"Copy BRIDGE_TOKEN from another machine's .env"},{value:"rotate",label:"Generate a new key",hint:"\u26A0 Agents on other machines will disconnect until reconfigured"}]}))==="manual"){let b=_(await o.text({message:"Paste your BRIDGE_TOKEN:",validate:O=>{if(!String(O). ...

18Config validation failed:`);for(let s of y.errors)console.error(`- ${s}`)}else{o.log.error("Config validation failed:");for(let s of y.errors)o.log.error(` \xB7 ${s}`)}process.exit(3)}t?console.log(`

19Step: Applying setup...`):o.log.step("Applying configuration"),G.mkdirSync(l.OUTPUT_ROOT,{recursive:!0});let C=dt({rootDir:$,values:l,profile:v}),ne=C.envPath,re=[`

20AGENTMARKET_EMAIL=${i.email}`];i.oauthAuth?re.push(`AGENTMARKET_REFRESH_TOKEN=${i.oauthAuth.refresh_token||""}`):i.password&&re.push(`AGENTMARKET_PASSWORD=${i.password}`),re.push(`AGENTMARKET_JWT=${D.jwt||""}`),G.appendFileSync(ne,re.join(`

21`)+`

22`,"utf8");let oe=t?null:o.spinner();oe?oe.start("Starting bridge process\u2026"):console.log("Starting bridge...");let z=await he({rootDir:$,profile:v,packageDir:we});oe&&oe.stop(`Bridge started (${z.mode}).`);let S=null,ie=!1;if(i?.agent){let s=t?null:o.

23AGENT CONNECTION KEY (shown only once \u2014 save this now):`),console.log(` ${l.BRIDGE_TOKEN}`),console.log(" The server stores only a hash; if lost you must regenerate.")),console.log(`

24\u2705 Setup complete`),console.log(`- profile: ${v}`),console.log(`- env file: ${C.envPath}`),C.backupPath&&console.log(`- backup: ${C.backupPath}`),console.log(`- marketplace URL: ${i.baseUrl||l.AGENTMARKET_BASE_URL}`),console.log("- connection mode: pull"),console.log(`- process mode: ${z.mode} (${z.appName})`),S?.ok&&(console.log(`- AgentMarket agent_id: ${S.agent_id}`),console.log("- Agent status: inactive (default)"),console.log('- Next steps: 1) Test your agent via "My Agents" \u2192 "Place Test Order"'),console.log(' 2) Once satisfied, click "Activate Agent" to go live')), ...

26\u26A0 This key is shown only once \u2014 the server stores only a hash.

27 Save it somewhere safe (password manager, secure backup).

28 If you lose it, you must regenerate it \u2014 which disconnects

29 any agents on other machines using the old key.`,"Agent connection key \u2014 save this now");let s=[`Profile: ${v}`,`Env file: ${C.envPath}`,C.backupPath?`Backup: ${C.backupPath}`:null,`Marketplace URL: ${i.baseUrl||l.AGENTMARKET_BASE_URL}`,"Connection mode: pull",`Process mode: ${z.mode} (${z.appName})`,S?.ok?`AgentMarket ID: ${

Long lines were clipped for display.