registry / forge-openclaw-plugin / 0.3.22

forge-openclaw-plugin@0.3.22

Curated OpenClaw adapter for the Forge collaboration API, UI entrypoint, and localhost auto-start runtime.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is a declared OpenClaw plugin that starts a local Forge runtime and proxies user-invoked Forge tool/API operations.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

OpenClaw plugin startup or user-invoked Forge tools/routes

Impact

Package-aligned local Forge access; no confirmed credential exfiltration or hidden remote control

Mechanism

declared local runtime bootstrap and Forge API proxy

Rationale

Source inspection shows high-risk primitives, but they are declared plugin behavior for managing a local Forge runtime and user/configured API calls. I found no hidden install-time execution, credential harvesting, attacker endpoint, destructive action, or unconsented AI-agent control hijack.

Evidence

package.jsonopenclaw.plugin.jsonserver/index.jsdist/openclaw/local-runtime.jsdist/openclaw/plugin-entry-shared.jsdist/openclaw/api-client.jsdist/openclaw/session-bootstrap.jsdist/openclaw/tools.jsdist/server/apps/api/src/health-weight-loss.js~/.openclaw/run/forge-openclaw-plugin/*.json~/.openclaw/logs/forge-openclaw-plugin/*.log.forge/generated/FORGE_SESSION_BOOTSTRAP.md~/.forge

Network endpoints4

127.0.0.1:4317127.0.0.1:3027/forge/api.openai.com/v1api.open-meteo.com/v1/forecast

Decision evidence

public snapshot

AI called this Clean at 86.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/openclaw/local-runtime.js spawns the packaged Forge server and may run npm install --omit=dev --ignore-scripts for missing packaged dependencies.
dist/openclaw/session-bootstrap.js registers an agent:bootstrap hook that adds .forge/generated/FORGE_SESSION_BOOTSTRAP.md to bootstrapFiles.
dist/openclaw/api-client.js sends configured apiToken as Bearer only to the configured Forge baseUrl and bootstraps local/Tailscale sessions.

Evidence against

package.json has no install/preinstall/postinstall/prepare lifecycle scripts; only build is defined.
openclaw.plugin.json declares onStartup activation, localhost runtime auto-start, sensitive apiToken config, and bootstrap-context injection as plugin features.
dist/openclaw/local-runtime.js limits auto-start to local origins and probes /api/v1/health on the configured localhost Forge URL.
dist/server/apps/api/src/health-weight-loss.js is nutrition/health database logic; inspected portions do not exfiltrate env or credentials.
Network use is package-aligned: local Forge API, configured LLM endpoints, OpenAI default profile, and weather widget endpoint; no hardcoded attacker endpoint found.
No evidence of import/install-time credential harvesting, persistence outside declared runtime state/logs, destructive behavior, or reviewer/prompt manipulation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 320 file(s), 9.63 MB of source, external domains: 127.0.0.1, accounts.google.com, api.nal.usda.gov, api.open-meteo.com, api.openai.com, apidata.googleusercontent.com, auth.openai.com, bit.ly, caldav.example.com, caldav.icloud.com, cdn.who.int, chatgpt.com, console.cloud.google.com, developers.google.com, example.com, forge.local, github.com, graph.microsoft.com, iris.who.int, learn.microsoft.com, login.microsoftonline.com, maplibre.org, mhpssknowledgehub.sph.cuny.edu, oauth2.googleapis.com, open.spotify.com, openclaw.local, openidconnect.googleapis.com, pro.reactflow.dev, radix-ui.com, react-dnd.github.io, react.dev, reactflow.dev, reactjs.org, redux-toolkit.js.org, redux.js.org, support.apple.com, world.openfoodfacts.org, www.anima.com.au, www.apple.com, www.googleapis.com, www.phqscreeners.com, www.ptsd.va.gov, www.w3.org, www.who.int

Source & flagged code

7 flagged

dist/openclaw/local-runtime.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/openclaw/local-runtime.jsView on unpkg · L1

3import net from "node:net";

4import { homedir } from "node:os";

5import path from "node:path";

6import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";

7import { fileURLToPath } from "node:url";

8const LOCAL_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1"]);

9const STARTUP_TIMEOUT_MS = 15_000;

10const HEALTHCHECK_TIMEOUT_MS = 1_500;

11const HEALTHCHECK_INTERVAL_MS = 250;

12const EXISTING_RUNTIME_GRACE_MS = 3_000;

13const MAX_PORT_SCAN_ATTEMPTS = 20;

14const FORGE_PLUGIN_ID = "forge-openclaw-plugin";

15let managedRuntimeChild = null;

16let managedRuntimeKey = null;

17let managedRuntimeLogPath = null;

18let lastRuntimeExitDetails = null;

19let startupPromise = null;

20let startupRuntimeKey = null;

21const dependencyInstallPromises = new Map();

Lines 489-529javascript

489 return { healthy: false, pid: null, storageRoot: null, basePath: null };

490 }

491 finally {

492 clearTimeout(timeout);

493 }

494}

495async function adoptManagedRuntimeState(config, probe) {

496

dist/server/apps/api/src/web.jsView file

Lines 50-90javascript

50 return value && value.length > 0 ? value : "npm run dev:web";

51}

52function getDefaultDevWebOriginPort(origin) {

53 if (origin?.port && origin.port.trim().length

dist/assets/motion-BryW_XlF.jsView file

Lines 1-10javascript

1import{r as T,j as nt}from"./vendor-SulnAwlf.js";const Qe=T.createContext({});function tn(t){const e=T.useRef(null);return e.current===null&&(e.current=t

dist/openclaw/session-registry.jsView file

Lines 32-72javascript

32 return normalized;

33 }

34 return `${normalized.slice(0, Math.max(0, limit - 1)).trimEnd()}…`;

35}

36function

dist/server/apps/api/src/health-weight-loss.jsView file

Lines 232-272javascript

232 .partial();

233export const nutritionParseRequestSchema = z.object({

234 text: z.string().trim().min(1),

235 mealTime: z.string().datetime().optional(),

236 imageRefs: z.

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 12681 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

Source & flagged code

7 flagged · loading source

dist/openclaw/local-runtime.jsView file

1import { spawn } from "node:child_process"; L2: import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/openclaw/local-runtime.jsView on unpkg · L1

509const enableManagedDevWeb = shouldEnableManagedDevWeb(plan); L510: const child = spawn(process.execPath, args, { L511: cwd: plan.packageRoot, L512: env: { L513: ...process.env, L514: HOST: "127.0.0.1", ... L518: ? { L519: FORGE_DEV_WEB_ORIGIN: process.env.FORGE_DEV_WEB_ORIGIN ?? "http://127.0.0.1:3027/forge/" L520: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/openclaw/local-runtime.jsView on unpkg · L509

dist/server/apps/api/src/web.jsView file

70env: input.env, L71: shell: true L72: };

High

Shell

Package source references shell execution.

dist/server/apps/api/src/web.jsView on unpkg · L70

dist/assets/motion-BryW_XlF.jsView file

8} L9: `),()=>{var R;(R=a.current)==null||R.removeAttribute("data-motion-pop-id"),C.contains(P)&&C.removeChild(P)}},[e]),nt.jsx(Tu,{isPresent:e,childRef:a,sizeRef:l,pop:r,children:r===!1?...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/assets/motion-BryW_XlF.jsView on unpkg · L8

dist/openclaw/session-registry.jsView file

52path: "/api/v1/agents/sessions", L53: body: { L54: provider: SESSION_PROVIDER, L55: agentLabel: process.env.FORGE_AGENT_LABEL?.trim() || DEFAULT_RUNTIME_AGENT_LABEL, L56: agentType: SESSION_PROVIDER,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/openclaw/session-registry.jsView on unpkg · L52

dist/server/apps/api/src/health-weight-loss.jsView file

252if (!candidate) { L253: return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC"; L254: } ... L296: try { L297: const parsed = JSON.parse(value); L298: return parsed ?? fallback; ... L1987: async function searchOpenFoodFacts(query, limit) { L1988: const url = new URL("https://world.openfoodfacts.org/cgi/search.pl"); L1989: url.searchParams.set("search_terms", query); ... L2005: async function lookupOpenFoodFactsBarcode(barcode) { L2006: const response = await fetch(`https://world.openfoodfacts.org/api/v2/product/${encodeURIComponent(barcode)}.json`, { headers: { accept: "application/json" } }); L2007: if (!response.ok) {

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/server/apps/api/src/health-weight-loss.jsView on unpkg · L252

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 12681 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg

Findings

1 Critical4 High5 Medium6 Low

CriticalCredential Exfiltrationdist/server/apps/api/src/health-weight-loss.js

HighChild Processdist/openclaw/local-runtime.js

HighShelldist/server/apps/api/src/web.js

HighSame File Env Network Executiondist/openclaw/local-runtime.js

HighShips High Entropy Blobdist/favicon.ico

MediumDynamic Requiredist/assets/motion-BryW_XlF.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/openclaw/session-registry.js

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/openclaw/local-runtime.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { closeSync, existsSync, mkdirSync, openSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/openclaw/local-runtime.jsView on unpkg · L1

3import net from "node:net";

4import { homedir } from "node:os";

5import path from "node:path";

6import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";

7import { fileURLToPath } from "node:url";

8const LOCAL_HOSTNAMES = new Set(["127.0.0.1", "localhost", "::1"]);

9const STARTUP_TIMEOUT_MS = 15_000;

10const HEALTHCHECK_TIMEOUT_MS = 1_500;

11const HEALTHCHECK_INTERVAL_MS = 250;

12const EXISTING_RUNTIME_GRACE_MS = 3_000;

13const MAX_PORT_SCAN_ATTEMPTS = 20;

14const FORGE_PLUGIN_ID = "forge-openclaw-plugin";

15let managedRuntimeChild = null;

16let managedRuntimeKey = null;

17let managedRuntimeLogPath = null;

18let lastRuntimeExitDetails = null;

19let startupPromise = null;

20let startupRuntimeKey = null;

21const dependencyInstallPromises = new Map();

Lines 489-529javascript

489 return { healthy: false, pid: null, storageRoot: null, basePath: null };

490 }

491 finally {

492 clearTimeout(timeout);

493 }

494}

495async function adoptManagedRuntimeState(config, probe) {

496

dist/server/apps/api/src/web.jsView file

Lines 50-90javascript

50 return value && value.length > 0 ? value : "npm run dev:web";

51}

52function getDefaultDevWebOriginPort(origin) {

53 if (origin?.port && origin.port.trim().length

dist/assets/motion-BryW_XlF.jsView file

Lines 1-10javascript

1import{r as T,j as nt}from"./vendor-SulnAwlf.js";const Qe=T.createContext({});function tn(t){const e=T.useRef(null);return e.current===null&&(e.current=t

dist/openclaw/session-registry.jsView file

Lines 32-72javascript

32 return normalized;

33 }

34 return `${normalized.slice(0, Math.max(0, limit - 1)).trimEnd()}…`;

35}

36function

dist/server/apps/api/src/health-weight-loss.jsView file

Lines 232-272javascript

232 .partial();

233export const nutritionParseRequestSchema = z.object({

234 text: z.string().trim().min(1),

235 mealTime: z.string().datetime().optional(),

236 imageRefs: z.

dist/favicon.icoView file

•path = dist/favicon.ico kind = high_entropy_blob sizeBytes = 12681 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/favicon.icoView on unpkg