Loading npm security reports…

clawd-go@1.0.6: AI-agent control-surface risk | LPM Firewall

registry / clawd-go / 1.0.6

clawd-go@1.0.6

Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack, Skill Hub (train2earn + skillhub-main), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically copies its skill pack and injects symlinks into multiple unrelated AI-agent skill roots. This changes the behavior available to Codex and Claude without an explicit setup command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall

Impact

Bundled instructions become active in installed AI-agent environments and can override same-named skill links.

Mechanism

Automatic creation and forceful replacement of AI-agent skill symlinks

Policy narrative

On npm installation, the postinstall script imports the skill installer by default. That installer copies the bundled pack into the user's Clawd directory, creates skill directories for generic agents, Claude, and Codex, then runs shell commands that use forceful symbolic-link replacement for every bundled skill. This is an unconsented install-time mutation of broad, foreign AI-agent control surfaces.

Rationale

The package performs the policy-defined blocking behavior: an npm postinstall modifies multiple foreign AI-agent skill roots by default. The lack of credential theft does not remove the confirmed control-surface hijack.

Evidence

package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjs~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills

Decision evidence

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/oneshot-install.mjsView file

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Write operation from scripts/oneshot-install.mjs: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L17: import { L18: copyFileSync, L19: cpSync, L20: existsSync, L21: mkdirSync, L22: readdirSync, ... L26: symlinkSync, L27: writeFileSync, L28: } from "node:fs"; Foreign user/project scop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/oneshot-install.mjsView on unpkg · L5

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

scripts/postinstall.mjsView file

48// Default: prepackage ALL bundled skills (fast, no Go/birth) if (process.env.CLAWDBOT_SKIP_SKILLS === "1") { if (!silent) { console.log(""); console.log(" 🦞 Clawd installed — skills prepackage skipped."); console.log(" Next: clawdbot install"); console.log(" Skills only: clawdbot install --skip-go --skip-birth --sk[redacted]"); console.log(" Product: https://cheshireterminal.ai/zeroclawd"); console.log(""); } return; } const installDir = process.env.CLAWDBOT_INSTALL_DIR ||

High

Suspicious Lifecycle Evidence

The postinstall path installs bundled skills unless an opt-out environment variable is set.

scripts/postinstall.mjsView on unpkg · L48

Source & flagged code

5 flagged

package.jsonView file

Lines 59-92json

59 "scripts/skill-pack.mjs",

60 "scripts/postinstall.mjs",

61 "scripts/pump-tape.mjs",

62 "install-npm.sh",

63 "install.sh",

64 "skills",

65 "automaton-main/package.json",

66 "automaton-main/README.md",

67 "automaton-main/src",

68 "automaton-main/scripts",

69 "automaton-main/constitution.md",

70 "automaton-main/LICENSE",

71 "docs/RH_CRYPTO_AGENT_STACK.md",

72 "README.md",

73 "LICENSE",

74 "AGENTS.md"

75 ],

76 "scripts": {

77 "oneshot": "node scripts/oneshot-install.mjs",

78 "install:stack": "node scripts/oneshot-install.mjs",

79 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L79

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L79

80 "skills:list": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

81 "skills:inspect": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(JSON.stringify(m.inspectPack(),null,2)))\"",

82 "test:oneshot": "node --test scripts/oneshot-install.test.mjs scripts/pump-tape.test.mjs",

83 "test:branding": "node --test scripts/branding-check.mjs",

84 "test:docs": "node --test scripts/docs-check.mjs",

85 "check": "node --check bin/clawdbot-go.mjs && node --check scripts/oneshot-install.mjs && node --check scripts/skill-pack.mjs && node --check scripts/postinstall.mjs && node --check scripts/pump-tape.mjs && npm run test:oneshot && npm run test:branding && npm run test:docs"

86 },

87 "preferGlobal": true,

88 "dependencies": {

89 "cheshire-terminal-agents": "^1.48.4"

90 }

91}

92

scripts/oneshot-install.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Clawd — one-shot stack installer (Grok Build style).

4 *

5 * Installs:

6 * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills

7 * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks

8 * • Optional: Go clawdbot binary, automaton-main deps, birth skill seeds

9 *

10 * Usage:

11 * npm i -g clawd-go

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9241 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

scripts/postinstall.mjsView file

Lines 28-68javascript

28 return;

29 }

30

31 const fullOneshot =

32 process.env.CLAWDBOT_ONESHOT === "1" ||

33 process.env.npm_config_oneshot ===