registry / openclaw-channel-shareopen / 1.3.7
openclaw-channel-shareopen@1.3.7
ShareOpen IM channel plugin for OpenClaw — agent-to-agent messaging with slash-command menu, approval fences, and model picker.
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe source shows configured ShareOpen authentication and message delivery, plus inbound media fetching; it does not substantiate the scanner’s remote decode-and-execute claim. No concrete malicious behavior was found.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
OpenClaw loads the extension and invokes its channel messaging or inbound media handling.
Impact
No confirmed malicious impact was established.
Mechanism
Outbound messages use the configured account token at the endpoint derived from the configured ShareOpen WebSocket URL. Inbound media is fetched into a bounded cache.
AI rationale
The source shows configured ShareOpen authentication and message delivery, plus inbound media fetching; it does not substantiate the scanner’s remote decode-and-execute claim. No concrete malicious behavior was found.
Network endpoints1
wss://shareopen.com/ws/agent
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json identifies index.js as the ShareOpen extension entrypoint; its configuration schema exposes the WebSocket URL and agent token.
- The outbound adapters derive the messaging endpoint from the configured ShareOpen WebSocket URL and send the configured account token with the requested message.
- The adapters resolve the URL and token from channel configuration or ShareOpen environment variables; index.js defaults to ShareOpen’s WebSocket endpoint and adds the token for authentication.
- The indexed fetch path downloads inbound media into a bounded cache; it does not decode and execute the fetched bytes.
Evidence against
Behavioral surface
CryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStrings
Source & flagged code
7 flaggedindex.jsView file
3L4: import WebSocket from 'ws';
L5: import fs from 'node:fs';
...
L30: if (!name || !SHARE_COMMANDS.some((c) => c.name === name.toLowerCase())) return undefined;
L31: return { kind: 'text-slash', source: 'text', authorized: true, commandName: name || undefined, body: b };
L32: }
...
L101: try {
L102: const p = path.join(os.homedir(), '.openclaw', 'openclaw.json');
L103: const j = JSON.parse(fs.readFileSync(p, 'utf8'));
L104: return j && j.channels ? j : null;
...
L241: let p = mediaUrl;
L242: if (p.startsWith('~')) p = p.replace(/^~(?=[/\\]|$)/, process.env.HOME || '');
Critical
Remote Asset Decode Execute
Source fetches a remote non-code asset, decodes its contents, and dynamically executes the decoded payload.
index.jsView on unpkg · L3•Trigger-reachable chain: manifest.main -> index.js
Reachable file contains a blocking source-risk pattern.
Critical
Trigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
index.jsView on unpkg3L4: import WebSocket from 'ws';
L5: import fs from 'node:fs';
...
L30: if (!name || !SHARE_COMMANDS.some((c) => c.name === name.toLowerCase())) return undefined;
L31: return { kind: 'text-slash', source: 'text', authorized: true, commandName: name || undefined, body: b };
L32: }
...
L101: try {
L102: const p = path.join(os.homedir(), '.openclaw', 'openclaw.json');
L103: const j = JSON.parse(fs.readFileSync(p, 'utf8'));
L104: return j && j.channels ? j : null;
...
L241: let p = mediaUrl;
L242: if (p.startsWith('~')) p = p.replace(/^~(?=[/\\]|$)/, process.env.HOME || '');
Findings
2 Critical3 Medium7 Low
CriticalRemote Asset Decode Executeindex.js
CriticalTrigger Reachable Dangerous Capabilityindex.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowWeak Cryptoindex.js
LowFilesystem
LowHigh Entropy Strings
LowAi Review Evidencepackage.json
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.js
LowAi Review Evidenceindex.mjs
Affected versions and remediation
This report applies to openclaw-channel-shareopen@1.3.7.
See all versions of openclaw-channel-shareopen for other recorded verdicts.
- Review the evidence and your use of openclaw-channel-shareopen@1.3.7 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.