registry / superclawd / 0.1.113
superclawd@0.1.113
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged process execution, network traffic, credentials, and repository hook support the package’s documented CLI, login, and memory features. The reviewed sources showed no unrelated credential transfer or harmful automatic action.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the CLI; login traffic occurs only when the user runs the login command, and memory hooks run during Claude Code sessions.
Impact
Expected service-backed CLI, memory, and repository-hook behavior; no unrelated credential transfer or harmful action was identified.
Mechanism
The CLI sends SuperClawd credentials to its own service and uses session data for its documented memory features. It also installs a post-commit hook for memory staleness checks.
AI rationale
The flagged process execution, network traffic, credentials, and repository hook support the package’s documented CLI, login, and memory features. The reviewed sources showed no unrelated credential transfer or harmful automatic action.
Evidence
~/.superclawd/config.json.git/hooks/post-commit
Network endpoints3
api.superclawd.commcp-api.superclawd.comregistry.npmjs.org
Decision evidence
public snapshotAI called this Clean at 84.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes dist/index.js as the CLI and main entry; its only lifecycle script is prepublishOnly, which builds the package.
- The README describes SuperClawd’s repo, agent, and private memory features, including AI-captured memories and controls for private memory.
- The CLI creates a post-commit hook for reporting learned-memory staleness, matching the documented memory feature.
- The login flow contacts api.superclawd.com only when the user runs the login command; the reviewed credential traffic is for the package’s own service.
Evidence against
- CLI launch automatically installs a repository hook and passes the user’s SuperClawd credentials to it.
- Session and agent transcripts can be processed for learned memories, and private memory is enabled by default.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
9 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: var Xe=["opus","fable","sonnet","haiku"],Un={opus:"claude-opus-5-5",fable:"claude-fable-5-1",sonnet:"claude-sonnet-5-5",haiku:"claude-haiku-5-5"},Wn=/^claude-(opus|fable|sonnet|hai...
L4: `,{mode:384});try{Bn(se,384)}catch{}}function nt(){return L()?.preferences?.sk[redacted]===!0}function qn(){return L()?.preferences?.notifications===!0}function rt(){return L()?...
L5: `)}catch{}}function ct(e,t,n=!1){et(lt(e))||Jn(e,{notifications:n?!1:qn(),...t?{workspace:t}:{}})}function ut(){et(se)||Y({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function Vn(){try{switch(process.platform){case"darwin":return
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: var Xe=["opus","fable","sonnet","haiku"],Un={opus:"claude-opus-5-5",fable:"claude-fable-5-1",sonnet:"claude-sonnet-5-5",haiku:"claude-haiku-5-5"},Wn=/^claude-(opus|fable|sonnet|hai...
L4: `,{mode:384});try{Bn(se,384)}catch{}}function nt(){return L()?.preferences?.sk[redacted]===!0}function qn(){return L()?.preferences?.notifications===!0}function rt(){return L()?...
High
Findings
1 Critical7 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to superclawd@0.1.113.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.113 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.