registry / nanoclaw-agenttrace / 0.1.0

nanoclaw-agenttrace@0.1.0

Live agent activity traces for NanoClaw — tools, tasks, reasoning summaries, and silence keepalives

AI Security Review

scanned 22h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicit `nanoclaw-agenttrace install` or `upgrade` mutates a detected NanoClaw project. It adds first-party tracing modules, patches NanoClaw boot/provider/container files, and installs a bundled Claude skill. No unconsented npm lifecycle execution or confirmed exfiltration is present.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `nanoclaw-agenttrace install`, `upgrade`, `sync-skill`, or `uninstall`.

Impact

Adds project-local AI-agent hooks and emits redacted activity events to the session’s own messaging channel.

Mechanism

Explicit NanoClaw extension installation and agent activity tracing.

Rationale

No install-time execution, remote payload retrieval, credential exfiltration, or stealth persistence was found. Flag as warn because an explicit command patches a NanoClaw/Claude agent control surface and adds a skill.

Evidence

package.jsondist/cli/bin.jsdist/cli/install.jsdist/cli/patch.jsskills/add-agenttrace/resources/runner/observe.tsskills/add-agenttrace/resources/runner/sanitize.tsskills/add-agenttrace/resources/runner/writer.tsskills/add-agenttrace/resources/agenttrace-delivery.tsskills/add-agenttrace/resources/agenttrace-env.ts

nanoclaw-agenttrace@0.1.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code