registry / AI-agent capability abuse / sealclaw / 2026.9.17

sealclaw@2026.9.17

Multi-channel AI gateway with extensible messaging integrations

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The inspected CLI performs user-triggered agent-facing wiki setup, which warrants a capability warning under the review policy. The install hooks shown are separate maintenance operations, and no concrete malicious chain was established.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

A user invokes a wiki initialization or related wiki operation that calls the vault initializer.

Impact

The generated guide can affect how an AI agent uses the wiki vault, but inspected source does not show broad agent configuration changes or credential exposure.

Mechanism

The CLI creates AGENTS.md and related wiki files only when absent, within the configured vault path.

AI rationale

Evidence

dist/cli-222jXmMR.js

Decision evidence

public snapshot

AI called this Suspicious at 79.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

The CLI initializer writes an agent-facing AGENTS.md into the configured wiki vault; this is a user-invoked wiki operation, not an npm install hook.
The npm install hooks run bundled-plugin maintenance and a pi-ai compatibility patch; they do not invoke the wiki initializer.
The audit helper enumerates plugin directories under the configured application state directory.

Evidence against

The inspected setup writes only when files are missing and targets the configured wiki vault; no evidence here shows credential collection, network transmission, or an install-time agent configuration change.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTelemetry

Source & flagged code

11 flagged

package.jsonView file

Lines 1409-1450json

1409 "lint:ui:no-raw-window-open": "node scripts/check-no-raw-window-open.mjs",

1410 "lint:webhook:no-low-level-body-read": "node scripts/check-webhook-auth-body-order.mjs",

1411 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1412 "openclaw": "node scripts/run-node.mjs",

1413 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1414 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1415 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1416 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1417 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1418 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1419 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1420 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1421 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1422 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1423 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1424 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1425 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1426 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1427 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1428 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1429 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1429

1430 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1430

1431 "prepush:ci": "bash scripts/prepush-ci.sh",

1432 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1433 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1434 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1435 "protocol:check": "pnpm protocol:gen && git diff --exit-code -- dist/protocol.schema.json",

1436 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1437 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1438 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1439 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1440 "proxy:run": "node scripts/run-node.mjs proxy run",

1441 "proxy:start": "node scripts/run-node.mjs proxy start",

1442 "release:beta-smoke": "node --import tsx scripts/release-beta-smoke.ts",

1443 "release:check": "pnpm deps:root-ownership:check && pnpm plugins:inventory:check && pnpm check:base-config-schema && pnpm check:bundled-channel-config-metadata && pnpm config:docs:check && pnpm plugin-sdk:check-exports && pnpm plugin-sdk:api:check && node --import tsx scripts/release-check.ts",

1444 "release:openclaw:npm:check": "node --import tsx scripts/openclaw-npm-release-check.ts",

1445 "release:openclaw:npm:verify-published": "node --import tsx scripts/openclaw-npm-postpublish-verify.ts",

1446 "release:plugins:npm:check": "node --import tsx scripts/plugin-npm-release-check.ts",

1447 "release:plugins:npm:plan": "node --import tsx scripts/plugin-npm-release-plan.ts",

1448 "runtime-sidecars:check": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --check",

1449 "runtime-sidecars:gen": "node --import tsx scripts/generate-runtime-sidecar-paths-baseline.ts --write",

1450 "start": "node scripts/run-node.mjs",

dist/control-ui/assets/pdf.worker-BuPrtjPZ.jsView file

1import{$ as e,h as t}from"./index-Be-w8Pbh.js";import{a as n,i as r,n as i,r as a,t as o}from"./classPrivateFieldSet2-DSsIYuru.js";var s,c,l,u,d,f,p,m,h,g,_,v,y,b,x,S,C,w,T={};T.d=... L2: `?`\\n`:e===`\r`?`\\r`:`\\${e}`)}function Yt(e,t,n,r){if(!e)return;let i=null;if(e instanceof F){if(r.has(e))return;i=e,r.put(i),e=t.fetch(e)}if(Array.isArray(e))for(let i of e)Yt(... L3: `+t:r.errorMessages=t}var Xe=(e,t)=>{te.set(e,t)};if(r.noExitRuntime&&(de=r.noExitRuntime),r.print&&(l=r.print),r.printErr&&(u=r.printErr),r.wasmBinary&&r.wasmBinary,r.arguments&&r...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/control-ui/assets/pdf.worker-BuPrtjPZ.jsView on unpkg · L1

dist/control-ui/assets/index-Be-w8Pbh.jsView file

6899contains invisible/control Unicode U+200C (zero width non-joiner) `}var o6=e(n(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function(

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-Be-w8Pbh.jsView on unpkg · L6899

1const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/docx-preview-DMEG690f.js","assets/chunk-62oNxeRG.js","assets/jszip.min-C9xvYp-s.js","assets/pptx-preview.es-eMvLaQp... L2: import{i as e,n as t,t as n}from"./chunk-62oNxeRG.js";import{a as r,c as i,i as a,l as o,n as s,o as c,r as l,s as u,t as d,u as f}from"./lit-Cfjy9bnZ.js";import{t as p}from"./requ... L3: `+re+e}var I=!1;function R(e,t){if(!e||I)return``;I=!0;var n=Error.prepareStackTrace;Error.prepareStackTrace=void 0;try{if(t)if(t=function(){throw Error()},Object.defineProperty(t.... ... L5: `),o=i.length-1,s=a.length-1;1<=o&&0<=s&&i[o]!==a[s];)s--;for(;1<=o&&0<=s;o--,s--)if(i[o]!==a[s]){if(o!==1||s!==1)do if(o--,s--,0>s||i[o]!==a[s]){var c=` L6: `+i[o].replace(` at new `,` at `);return e.displayName&&c.includes(`<a

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/control-ui/assets/index-Be-w8Pbh.jsView on unpkg · L1

•stage = ast_semantic_analysis; reason = ast_trace_path_limit_exceeded; limitedFiles = 1

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView file

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = payload_in_excluded_dir sizeBytes = 16667 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

•path = skills/llm-wiki-ingest/tests/test_ingest_scripts.py kind = build_helper sizeBytes = 16667 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/llm-wiki-ingest/tests/test_ingest_scripts.pyView on unpkg

dist/plugin-sdk/plugin-test-contracts.jsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = dist/plugin-sdk/plugin-test-contracts.js matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/plugin-sdk/plugin-test-contracts.jsView on unpkg

scripts/preinstall-package-manager-warning.mjsView file

•matchType = normalized_sha256 matchedPackage = sealclaw@2026.9.3 matchedPath = scripts/preinstall-package-manager-warning.mjs matchedIdentity = npm:c2VhbGNsYXc:2026.9.3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = sealclaw@2026.9.1 matchedIdentity = npm:c2VhbGNsYXc:2026.9.1 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/preinstall-package-manager-warning.mjsView on unpkg

Source & flagged code

11 flagged · loading source

package.jsonView file

•scripts.preinstall = node scripts/preinstall-package-manager-warning.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/control-ui/assets/pdf.worker-BuPrtjPZ.jsView file

Findings

1 Critical7 High6 Medium6 Low

CriticalTrojan Source Unicodedist/control-ui/assets/index-Be-w8Pbh.js

HighInstall Time Lifecycle Scriptspackage.json

HighCloud Metadata Accessdist/control-ui/assets/index-Be-w8Pbh.js

HighPayload In Excluded Dirskills/llm-wiki-ingest/tests/test_ingest_scripts.py

HighSemantic Analysis Limiteddist/control-ui/assets/index-Be-w8Pbh.js

HighKnown Malware Source Similaritydist/plugin-sdk/plugin-test-contracts.js

HighKnown Malware Source Similarityscripts/preinstall-package-manager-warning.mjs

HighPrevious Version Dangerous Deltascripts/preinstall-package-manager-warning.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/control-ui/assets/pdf.worker-BuPrtjPZ.js

Affected versions and remediation

This report applies to sealclaw@2026.9.17.

See all versions of sealclaw for other recorded verdicts.

Review the evidence and your use of sealclaw@2026.9.17 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-08 15:56:59.221Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.