registry / clawdbot-go / 1.0.3

clawdbot-go@1.0.3

Clawd Bot — one-shot install for sovereign Solana + Robinhood omni agent runtime: RH skill pack (23), agents, packages, clawdbot CLI hooks. Connect at cheshireterminal.ai/zeroclawd

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. On npm install, the package installs a bundled skill pack then creates/replaces skill symlinks in three broad AI-agent configuration roots. This mutates foreign agent control surfaces without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install of clawdbot-go@1.0.3

Impact

Bundled instructions become available to Codex, Claude, and generic agent hosts, altering their future behavior.

Mechanism

postinstall copies skills and force-links them into agent hosts

Policy narrative

Installing the package triggers postinstall without a user invoking its CLI. The hook installs bundled skills under ~/.clawdbot/skills and uses bash with ln -sfn to create or replace entries across ~/.agents/skills, ~/.claude/skills, and ~/.codex/skills. These are broad foreign AI-agent control surfaces, so the package persistently injects its bundled agent instructions into unrelated hosts.

Rationale

The automatic postinstall mutation of ~/.agents, ~/.claude, and ~/.codex meets the block policy for an unconsented broad AI-agent control-surface write. No additional exfiltration is needed for this concrete lifecycle attack.

Evidence

package.jsonscripts/postinstall.mjsscripts/oneshot-install.mjsskills/~/.clawdbot/skills~/.agents/skills~/.claude/skills~/.codex/skills

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 98.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall automatically.
postinstall imports and invokes the skill installer by default.
Installer targets ~/.agents, ~/.claude, and ~/.codex skill roots.
Installer force-replaces symlinks for every bundled skill in those roots.

Evidence against

No network request or credential harvesting is present in the npm postinstall path.
The injected content is bundled locally rather than fetched during postinstall.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 27.3 KB of source, external domains: cheshireterminal.ai, clawdrouter-zk.fly.dev, funpump.ai, github.com, raw.githubusercontent.com, www.npmjs.com

Source & flagged code

6 flagged

package.jsonView file

Lines 52-88json

52 "bin",

53 "bin/clawdbot-go.js",

54 "bin/clawdbot-go.mjs",

55 "scripts/oneshot-install.mjs",

56 "scripts/skill-pack.mjs",

57 "scripts/postinstall.mjs"

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

72"scripts": { "oneshot": "node scripts/oneshot-install.mjs", "install:stack": "node scripts/oneshot-install.mjs", "postinstall": "node scripts/postinstall.mjs", "skills:list": "node -e \"import('./scripts/sk[redacted]').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

package.json runs postinstall automatically.

package.jsonView on unpkg · L72

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/oneshot-install.mjsView file

Findings

1 Critical3 High4 Medium4 Low

CriticalAi Agent Control Hijackscripts/oneshot-install.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/postinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helperinstall-npm.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LPM CLI

5Install-time code directly mutates a foreign AI-agent control surface: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L15: import { L16: copyFileSync, L17: cpSync, L18: existsSync, L19: mkdirSync, L20: readdirSync, ... L24: symlinkSync, L25: writeFileSync, L26: } from "node:fs"; Write operation from scripts/oneshot-install.mjs: L5: * Installs: L6: * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills L7: * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks ... L15: import { L16: copyFileSync, L17: cpSync, L18: existsSync, L19: mkdirSync, L20: readdirSync, ... L24: symlinkSync, L25: writeFileSync, L26: } from "node:fs"; Foreign user/project scop

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/oneshot-install.mjsView on unpkg · L5

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9631 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

scripts/postinstall.mjsView file

61const installDir = process.env.CLAWDBOT_INSTALL_DIR || join(homedir(), ".clawdbot"); const result = installSkillPackOnly({ installDir, force: process.env.CLAWDBOT_FORCE === "1", });

High

Suspicious Lifecycle Evidence

postinstall imports and invokes the skill installer by default.

scripts/postinstall.mjsView on unpkg · L61

Entrypoints

exports mapbin → clawd-bot, clawdbot-go, clawdbot-stack +1

Runtimenode >=18.18

Artifact989 KB · 21 files1 signature(s)

Install lifecyclepostinstall

Behavioral surface

ChildProcessEnvironmentVarsFilesystemShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

6 flagged

package.jsonView file

Lines 52-88json

52 "bin",

53 "bin/clawdbot-go.js",

54 "bin/clawdbot-go.mjs",

55 "scripts/oneshot-install.mjs",

56 "scripts/skill-pack.mjs",

57 "scripts/postinstall.mjs"

,

58 "install-npm.sh",

59 "install.sh",

60 "skills",

61 "automaton-main/package.json",

62 "automaton-main/README.md",

63 "automaton-main/src",

64 "automaton-main/scripts",

65 "automaton-main/constitution.md",

66 "automaton-main/LICENSE",

67 "docs/RH_CRYPTO_AGENT_STACK.md",

68 "README.md",

69 "LICENSE",

70 "AGENTS.md"

71 ],

72 "scripts": {

73 "oneshot": "node scripts/oneshot-install.mjs",

74 "install:stack": "node scripts/oneshot-install.mjs",

75 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L75

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L75

76 "skills:list": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(m.listSkillIds().join('\\n')))\"",

High

Suspicious Lifecycle Evidence

package.json runs postinstall automatically.

package.jsonView on unpkg · L72

77 "skills:inspect": "node -e \"import('./scripts/skill-pack.mjs').then(m=>console.log(JSON.stringify(m.inspectPack(),null,2)))\"",

78 "test:oneshot": "node --test scripts/oneshot-install.test.mjs",

79 "test:branding": "node --test scripts/branding-check.mjs",

80 "test:docs": "node --test scripts/docs-check.mjs",

81 "check": "node --check bin/clawdbot-go.mjs && node --check scripts/oneshot-install.mjs && node --check scripts/skill-pack.mjs && node --check scripts/postinstall.mjs && npm run test:oneshot && npm run test:branding && npm run test:docs"

82 },

83 "preferGlobal": true,

84 "dependencies": {

85 "cheshire-terminal-agents": "^1.48.0"

86 }

87}

88

scripts/oneshot-install.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * Clawd Bot — one-shot stack installer (Grok Build style).

4 *

5 * Installs:

6 * • RH / Cheshire skill pack (23 skills) → ~/.clawdbot/skills + ~/.agents/skills

7 * • Env template with CLAWDBOT_SKILLS_DIR, RH hooks

8 * • Optional: Go clawdbot binary, automaton-main deps, birth skill seeds

9 *

10 * Usage:

11 * npx clawdbot-go install

install-npm.shView file

•path = install-npm.sh kind = build_helper sizeBytes = 9631 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install-npm.shView on unpkg

scripts/postinstall.mjsView file

Lines 41-81javascript

41 skipBirth: process.env.CLAWDBOT_SKIP_BIRTH === "1",

42 skipAutomaton: process.env.CLAWDBOT_SKIP_AUTOMATON === "1",

43 force: process.env.CLAWDBOT_FORCE ===

12 * node scripts/oneshot-install.mjs [--skip-go] [--skip-birth] [--dir PATH]

13 * curl -fsSL https://raw.githubusercontent.com/Solizardking/Zero-Bruh/main/install-npm.sh | bash

14 */

15import {

16 copyFileSync,

17 cpSync,

18 existsSync,

19 mkdirSync,

20 readdirSync,

21 readFileSync,

22 rmSync,

23 statSync,

24 symlinkSync,

25 writeFileSync,

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/oneshot-install.mjsView on unpkg · L5

"1"

,

44 });

45 return;

46 }

47

48 // Default: prepackage ALL bundled skills (fast, no Go/birth)

49 if (process.env.CLAWDBOT_SKIP_SKILLS === "1") {

50 if (!silent) {

51 console.log("");

52 console.log(" 🦞 Clawd Bot (clawdbot-go) installed — skills prepackage skipped.");

53 console.log(" One-shot skills: npx clawdbot-go install --skip-go --skip-birth --skip-automaton");

54 console.log(" Full stack: npx clawdbot-go install");

55 console.log(" Product: https://cheshireterminal.ai/zeroclawd");

56 console.log("");

57 }

58 return;

59 }

60

61 const installDir =

62 process.env.CLAWDBOT_INSTALL_DIR || join(homedir(), ".clawdbot");

63 const result = installSkillPackOnly({

64 installDir,

65 force: process.env.CLAWDBOT_FORCE === "1",

66 });

High

Suspicious Lifecycle Evidence

postinstall imports and invokes the skill installer by default.

scripts/postinstall.mjsView on unpkg · L61

67

68 if (!silent) {

69 console.log("");

70 console.log(" 🦞 Clawd Bot — skill pack prepackaged (npm clawdbot-go)");

71 console.log(` Skills: ${result.skillCount} → ${result.skillsDir}`);

72 console.log(` Linked: ${result.linked} agent skill entries`);

73 console.log(` export CLAWDBOT_SKILLS_DIR="${result.skillsDir}"`);

74 console.log(" Full stack (Go + birth): npx clawdbot-go install");

75 console.log(

76 " Curl oneshot: curl -fsSL https://raw.githubusercontent.com/Solizardking/Zero-Bruh/main/install-npm.sh | bash",

77 );

78 console.log(" Product: https://cheshireterminal.ai/zeroclawd");

79 console.log("");

80 }

81 } catch (err) {