registry / openclaw-channel-shareopen / 1.3.10
openclaw-channel-shareopen@1.3.10
ShareOpen IM channel plugin for OpenClaw — agent-to-agent messaging with slash-command menu, approval fences, and model picker.
AI Security Review
scanned 10d ago · by lpm-firewall-aiSource inspection found no install hook or remote payload execution. The network and token use match the package's ShareOpen channel function, and the flagged download handles inbound media without executing it.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Starting a configured channel account or sending an agent reply.
Impact
No harmful impact was confirmed; the account token is used for channel authentication and replies go to the configured service.
Mechanism
The main adapter connects to the account's WebSocket URL; alternate adapters post replies to the URL derived from the same account setting and authenticate with its token.
AI rationale
Source inspection found no install hook or remote payload execution. The network and token use match the package's ShareOpen channel function, and the flagged download handles inbound media without executing it.
Network endpoints1
wss://shareopen.com/ws/agent
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest identifies index.js as the package entrypoint and extension.
- The main adapter gets its token and endpoint from ShareOpen account configuration, then connects to the ShareOpen WebSocket service.
- Both alternate adapters send agent replies to the URL derived from the configured account endpoint, using that account's token for authentication.
- The flagged fetch downloads inbound media from a supplied URL, rejects oversized files, and saves the bytes; the inspected source does not decode or execute the download.
Evidence against
- The scanner's remote-asset execution finding is not supported by the inspected fetch behavior; the SHA-1 use is only for an inbound-media cache filename.
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
7 flaggedindex.jsView file
3L4: import WebSocket from 'ws';
L5: import fs from 'node:fs';
...
L30: if (!name || !SHARE_COMMANDS.some((c) => c.name === name.toLowerCase())) return undefined;
L31: return { kind: 'text-slash', source: 'text', authorized: true, commandName: name || undefined, body: b };
L32: }
...
L101: try {
L102: const p = path.join(os.homedir(), '.openclaw', 'openclaw.json');
L103: const j = JSON.parse(fs.readFileSync(p, 'utf8'));
L104: return j && j.channels ? j : null;
...
L241: let p = mediaUrl;
L242: if (p.startsWith('~')) p = p.replace(/^~(?=[/\\]|$)/, process.env.HOME || '');
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L3•Trigger-reachable chain: manifest.main -> index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg3L4: import WebSocket from 'ws';
L5: import fs from 'node:fs';
...
L30: if (!name || !SHARE_COMMANDS.some((c) => c.name === name.toLowerCase())) return undefined;
L31: return { kind: 'text-slash', source: 'text', authorized: true, commandName: name || undefined, body: b };
L32: }
...
L101: try {
L102: const p = path.join(os.homedir(), '.openclaw', 'openclaw.json');
L103: const j = JSON.parse(fs.readFileSync(p, 'utf8'));
L104: return j && j.channels ? j : null;
...
L241: let p = mediaUrl;
L242: if (p.startsWith('~')) p = p.replace(/^~(?=[/\\]|$)/, process.env.HOME || '');
Findings
2 Critical3 Medium7 Low
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptoindex.js
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.js
Affected versions and remediation
This report applies to openclaw-channel-shareopen@1.3.10.
See all versions of openclaw-channel-shareopen for other recorded verdicts.
- Review the evidence and your use of openclaw-channel-shareopen@1.3.10 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.