registry / openclaw-channel-bgos / 0.16.0

openclaw-channel-bgos@0.16.0

OpenClaw channel plugin: chat with your OpenClaw agents in BGOS

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. Configured runtime bridges BGOS messages into a local OpenClaw agent and exposes a localhost peers API. It also imports a backend-served capability guide into each agent system prompt, creating a bounded but real remote prompt-control surface.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User configures/loads the OpenClaw BGOS plugin or explicitly runs `bgos-openclaw-daemon`.

Impact

A compromised configured BGOS backend could influence shell-capable agent behavior through the injected capability text; no install-time compromise is present.

Mechanism

Agent-channel bridge with backend-supplied system-prompt injection and local CLI fallback.

Rationale

The package is not malicious by static source evidence, but it creates an externally influenced control path into an AI-agent runtime. Its lifecycle, file writes, and process execution are explicit runtime features rather than hidden installation behavior.

Evidence

package.jsonopenclaw.plugin.jsondist/daemon.jsdist/bgos-hints-inject.jsdist/openclaw-gateway-client.jsdist/pair-cli.jsdist/doctor.js~/.openclaw/secrets/bgos.json~/.openclaw/secrets/bgos-peers-token~/.openclaw/state/bgos-cursor.json

Network endpoints3

/api/v1

openclaw-channel-bgos@0.16.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code