registry / AI-agent control-surface risk / clawdbot-go
clawdbot-go
Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack, Skill Hub (train2earn + skillhub-main), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd
This report shows the evidence for clawdbot-go@1.0.6. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe automatic postinstall mutation of broad, foreign AI-agent skill directories is a concrete unconsented control-surface change. No credential theft was found, but the lifecycle behavior meets the blocking policy.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
npm installation, unless the user sets opt-out environment variables.
Impact
Bundled instructions become available to other installed AI-agent hosts and can influence their later behavior.
Mechanism
Postinstall copies skills and creates global agent-directory symlinks through bash.
Policy narrative
On package installation, postinstall calls the skills installer by default. It copies the packaged skill tree into the user home directory, then runs bash to create or replace symlinks under generic agent, Claude, and Codex skill directories. Those directories are shared control surfaces for separate AI-agent products, so future agent sessions can load package-provided instructions without the user having explicitly run this package's setup command. The postinstall path can also display a bounded live network tape.
AI rationale
The automatic postinstall mutation of broad, foreign AI-agent skill directories is a concrete unconsented control-surface change. No credential theft was found, but the lifecycle behavior meets the blocking policy.
Evidence
package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjsscripts/pump-tape.mjs~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills
Network endpoints1
wss://clawd-ws.fly.dev/ws
Decision evidence
public snapshotAI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.
Evidence for policy risk
- The package runs a postinstall script automatically.
- Postinstall installs the bundled skill pack unless an opt-out environment variable is set.
- The installer copies skills and creates links in Claude, Codex, and generic agent skill directories under the user home directory.
- The links are made through a shell batch during installation, affecting foreign agent control surfaces.
- Postinstall also invokes an install-time live network tape when applicable.
Evidence against
- No source code inspected reads or sends local credentials, shell history, or arbitrary user files.
- The bundled skill pack is copied from the package itself; no remote code is fetched by the default postinstall path.
- The network tape is described as bounded and non-fatal, not as a payload downloader.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
5 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg76"scripts": {
"oneshot": "node scripts/oneshot-install.mjs",
"install:stack": "node scripts/oneshot-install.mjs",
"postinstall": "node scripts/postinstall.mjs",
"skills:list": "node -e \"import('./scripts/sk[redacted]').then(m=>console.log(m.listSkillIds().join('\\n')))\"",
High
Suspicious Lifecycle Evidence
The package runs a postinstall script automatically.
package.jsonView on unpkg · L76•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgscripts/oneshot-install.mjsView file
Findings
1 Critical2 High5 Medium4 Low
CriticalAi Agent Control Hijackscripts/oneshot-install.mjs
HighInstall Time Lifecycle Scriptspackage.json
HighSuspicious Lifecycle Evidencepackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperinstall-npm.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to clawdbot-go@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing clawdbot-go@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
Versions
4 known versions1.0.6latestshownMaliciousSoft block: AI-agent control surfaceBlockPublishedAug 26, 2026, 7:19 PM1.0.5MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 26, 2026, 7:13 PM1.0.4MaliciousInstall Hook AbuseBlockPublishedAug 26, 2026, 6:59 PM1.0.3MaliciousSoft block: AI-agent control surfaceBlockPublishedAug 15, 2026, 5:49 PM