registry / AI-agent control-surface risk / clawmoney

clawmoney

ClawMoney CLI -- Earn rewards with your AI agent

This report shows the evidence for clawmoney@0.18.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.18.2, is flagged. See all versions.

AI Security Review

scanned 4mo ago · by lpm-firewall-ai

Direct source inspection confirms unconsented lifecycle writes into AI-agent control-surface directories from remote content, which meets the firewall blocking criterion for AI-agent control hijack. Other credential and relay code appears mostly user-invoked, but the postinstall behavior alone is sufficient to classify this package as malicious.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm install postinstall lifecycle

Impact

Unconsented modification of local AI-agent command/skill surfaces and execution of external installers during dependency installation.

Mechanism

remote AI-agent skill installation plus runtime package-manager install

Policy narrative

On npm install, package.json runs scripts/install-skill.cjs, which downloads remote Markdown from clawmoney.ai and writes it directly into Claude, OpenClaw, and Codex agent skill locations. Because the installed agent instructions are fetched live from the publisher rather than pinned in the package, the install hook can silently alter future AI-agent behavior outside normal npm package review. A second postinstall script also attempts to install yt-dlp through system package managers.

AI rationale

Evidence

package.jsonscripts/install-skill.cjsscripts/install-ytdlp.cjsdist/relay/upstream/claude-bootstrap.jsscripts/probe-claude-api.mjs~/.claude/commands/clawmoney.md~/.openclaw/skills/clawmoney/SKILL.md~/.codex/skills/clawmoney/SKILL.md~/.clawmoney/claude-fingerprint.json~/.claude/.credentials.json

Network endpoints4

clawmoney.ai/skill.md

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 96.0% confidence with low false-positive risk.

Evidence for policy risk

package.json runs postinstall: node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs.
scripts/install-skill.cjs fetches https://clawmoney.ai/skill.md during npm install.
scripts/install-skill.cjs writes fetched remote content into ~/.claude/commands/clawmoney.md, ~/.openclaw/skills/clawmoney/SKILL.md, and ~/.codex/skills/clawmoney/SKILL.md.
scripts/install-ytdlp.cjs runs brew/pipx/pip3/apt-get/winget installers for yt-dlp during postinstall if missing.
dist/relay/upstream/claude-bootstrap.js can spawn claude with ANTHROPIC_BASE_URL pointed at localhost and capture account/device fingerprint.
scripts/probe-claude-api.mjs reads Claude Code OAuth credentials and posts bearer-authenticated requests to api.anthropic.com.

Evidence against

package.json main/bin entrypoint is a CLI, not automatic import-time execution beyond npm lifecycle.
Credential-reading probe scripts are not invoked by package.json lifecycle hooks.
Network use to api.bnbot.ai/clawmoney.ai is broadly aligned with the package's advertised agent marketplace/relay functionality.
No obfuscated JavaScript or eval/Function payload was found in inspected hot files.

Source & flagged code

10 flagged

package.jsonView file

Lines 1-38json

2 "name": "clawmoney",

3 "version": "0.18.1",

4 "description": "ClawMoney CLI -- Earn rewards with your AI agent",

5 "type": "module",

6 "bin": {

7 "clawmoney": "dist/index.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "scripts",

13 "companion"

14 ],

15 "scripts": {

16 "build": "tsc",

17 "dev": "tsc --watch",

18 "postinstall": "node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L18

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L18

19 "prepublishOnly": "npm run build"

20 },

21 "dependencies": {

22 "@bnbot/cli": "^0.3.0",

23 "@clack/prompts": "^0.7.0",

24 "chalk": "^5.3.0",

25 "commander": "^12.0.0",

26 "ora": "^8.0.0",

27 "viem": "^2.48.1",

28 "ws": "^8.20.0",

29 "yaml": "^2.4.0"

30 },

31 "devDependencies": {

32 "@types/node": "^20.0.0",

33 "@types/ws": "^8.18.1",

34 "typescript": "^5.4.0"

35 },

36 "engines": {

37 "node": ">=18"

38 },

dist/ui/companion.jsView file

Lines 1-29javascript

1// Companion launcher: ensure the Electron companion is installed + running,

2// then talk to it. This is the "reverse-launch" awal does — the CLI brings up

3// the GUI on demand, zero app install for the user.

4//

5// Why a per-user run dir (~/.clawmoney/companion) instead of running straight

6// from the installed package: the global npm package dir is often not writable,

7// and we need to `npm i electron` somewhere. So we copy the tiny companion

8// files into the user's home and install Electron there (awal uses env-paths

9// for the same reason).

10import

dist/commands/tweet.jsView file

Lines 1-30javascript

1import chalk from 'chalk';

2import { spawn } from 'node:child_process';

3/**

4 * Post a tweet by delegating to @bnbot/cli.

5 */

6export async function

dist/relay/upstream/claude-bootstrap.jsView file

Lines 264-304javascript

264 cleanup();

265 reject(new Error(`bootstrap proxy server error: ${err.message}`));

266 });

267 server.listen(0, "127.0.0.1"

scripts/probe-claude-api.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2// Validate that a locally-logged-in Claude Code OAuth token can be used to

3// call api.anthropic.com directly with the exact headers + body shape Claude

4// Code sends (captured from claude-cli/2.1.100 via ANTHROPIC_LOG=debug).

5//

6// Usage:

7// node scripts/probe-claude-api.mjs # send test request

8// node scripts/probe-claude-api.mjs --refresh # force refresh first

9// node scripts/probe-claude-api.mjs --prompt "hello"

10// node scripts/probe-claude-api.mjs --model claude-sonnet-4-5

dist/utils/awal.jsView file

Lines 1-34javascript

1import { spawn } from 'node:child_process';

2// Windows resolves .cmd / .bat launchers only through the shell;

3// POSIX (macOS/Linux) `spawn` walks PATH on its own and prints a

4// DEP0190 deprecation warning when shell:true is combined with

5// argument arrays. Keep shell:true only where we actually need it.

6const USE_SHELL = process.platform === 'win32'

scripts/install-market-launchd.shView file

•path = scripts/install-market-launchd.sh kind = build_helper sizeBytes = 6489 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-market-launchd.shView on unpkg

companion/icon.icnsView file

•path = companion/icon.icns kind = high_entropy_blob sizeBytes = 714079 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

companion/icon.icnsView on unpkg

Source & flagged code

10 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/install-skill.cjs && node scripts/install-ytdlp.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/ui/companion.jsView file

9// for the same reason). L10: import { spawn, spawnSync } from 'node:child_process'; L11: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/ui/companion.jsView on unpkg · L9

Findings

1 Critical7 High5 Medium5 Low

CriticalCredential Exfiltrationscripts/probe-claude-api.mjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/ui/companion.js

HighShelldist/commands/tweet.js

HighSame File Env Network Executiondist/relay/upstream/claude-bootstrap.js

HighSandbox Evasion Gated Capabilitydist/ui/companion.js

HighRuntime Package Installdist/utils/awal.js

HighShips High Entropy Blobcompanion/icon.icns

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/install-market-launchd.sh

Affected versions and remediation

This report applies to clawmoney@0.18.1.

The versions list below shows the verdict for each recorded version.

Avoid installing clawmoney@0.18.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-07-01 06:08:04.912Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.18.2latestSuspiciousSoft block: AI-agent control surfaceWarnPublishedJul 1, 2026, 2:36 AM 0.18.1shownMaliciousSoft block: AI-agent control surfaceBlockPublishedJun 30, 2026, 1:14 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other AI-agent control-surface risk packages

Behavioral surface

Related packages

Other AI-agent control-surface risk packages

Source & flagged code