clawhub@0.25.0
ClawHub CLI \u2014 install, update, search, and publish skills plus OpenClaw packages.
AI Security Review
scanned 4d ago · by lpm-firewall-aiThe CLI sends source-identifying install telemetry to its own registry by default, without a README disclosure found in this review. Because it is triggered by a user-run install or update and can be disabled, this warrants a warning rather than a malicious verdict.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user installs or updates a skill with an available ClawHub token.
Impact
The registry receives source identifiers such as repository and path, which can reveal what a user is installing.
Mechanism
The CLI posts the install event, slug, and available owner and source metadata to the configured registry; telemetry can be disabled with CLAWHUB_DISABLE_TELEMETRY or CLAWDHUB_DISABLE_TELEMETRY.
AI rationale
The CLI sends source-identifying install telemetry to its own registry by default, without a README disclosure found in this review. Because it is triggered by a user-run install or update and can be disabled, this warrants a warning rather than a malicious verdict.
Evidence
dist/cli/commands/installTelemetry.jsdist/cli/commands/skills.jsdist/cli/registry.js
Network endpoints1
clawhub.ai (default registry; configurable)
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After skill installation, the CLI sends telemetry containing the skill slug and available owner and source metadata, including repository and path.
- Telemetry is enabled by default when a token is present; an environment variable can disable it.
- The default registry endpoint is https://clawhub.ai.
Evidence against
- The telemetry runs after a user-requested skill install or update, rather than on package import or installation.
- The package has no npm install hook; its only lifecycle script is prepublishOnly, which runs a build.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/cli/ui.jsView file
1import { spawn } from "node:child_process";
L2: import { stdin } from "node:process";
High
•matchType = previous_version_dangerous_delta
matchedPackage = clawhub@0.24.1
matchedIdentity = npm:Y2xhd2h1Yg:0.24.1
similarity = 0.854
summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli/ui.jsView on unpkgdist/cli/commands/github.jsView file
1import { spawnSync } from "node:child_process";
L2: import { mkdir, mkdtemp, rm, stat, writeFile } from "node:fs/promises";
...
L11: function resolveGitHubApi() {
L12: const testUrl = process.env.CLAWHUB_TEST_GITHUB_API_URL?.trim();
L13: if (process.env.NODE_ENV !== "test" || !testUrl)
L14: return "https://api.github.com";
L15: const url = new URL(testUrl);
Findings
4 High3 Medium5 Low
HighChild Processdist/cli/ui.js
HighSame File Env Network Executiondist/cli/commands/github.js
HighSemantic Analysis Limiteddist/schema/templatePackage.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/cli/ui.js
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/cli/commands/installTelemetry.js
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to clawhub@0.25.0.
See all versions of clawhub for other recorded verdicts.
- Review the evidence and your use of clawhub@0.25.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.