registry / superclawd / 0.1.2

superclawd@0.1.2

Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 463 KB of source, external domains: api.superclawd.com, claude.com, github.com, json-schema.org, mcp-api.superclawd.com, raw.githubusercontent.com, registry.npmjs.org, superclawd.com

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3import{spawn as tn,spawnSync as Dr,execSync as Or}from"node:child_process";import{fileURLToPath as en}from"node:url";import{existsSync as nn}from"node:fs";import{resolve as Tr,dirname as Ur,join as Wr}from"node:path";import{homedir as on}from"node:os";import{join as Z}from"node:path";import{randomBytes as sn}from"node:crypto";import{readFileSync as an,writeFileSync as Oe,mkdirSync as Te,chmodSync as cn,existsSync as Ue}from"node:fs";var H=(process.env.SUPERCLAWD_BACKEND||"real").toLowerCase(),k=H==="mock",B=process.env.SUPERCLAWD_MCP_API_URL||"https://mcp-api.superclawd.com",ee=process.env.SUP ...

4`,{mode:384});try{cn(Q,384)}catch{}}function Ne(){return P()?.preferences?.skipPermissions===!0}function un(){return P()?.preferences?.notifications===!0}function Ge(){return P()?.preferences?.chooseWorkspaceAtStartup!==!1}function we(e){let t=P()??{};G({...t,credentials:{...t.credentials,workspace:e}})}function ne(){let e=P();e?.credentials?.workspace&&G({...e,credentials:{...e.credentials,workspace:""}})}function je(){return P()?.preferences?.experimental===!0}function Fe(){return P()?.preferences?.keepAwake===!0}function Ke(){return P()?.preferences?.privateMemory!==!1}function Ye(){return ...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

5`)}catch{}}function He(e,t){Ue(Be(e))||pn(e,{notifications:un(),...t?{workspace:t}:{}})}function qe(){Ue(Q)||G({credentials:{keyId:"",secret:"",workspace:""},preferences:{notifications:!1,skipPermissions:!1,chooseWorkspaceAtStartup:!

6`)};function dn(){try{switch(process.platform){case"darwin":return Se("caffeinate",["-i","-w",String(process.pid)],{stdio:"ignore"});case"linux":return Se("systemd-inhibit",["--what=sleep:idle","--who=SuperClawd","--why=SuperClawd session running","--mode=block","cat"],{stdio:["pipe","ignore","ignore"]});case"win32":{let e=[`$p = Add-Type -MemberDefinition '[DllImport("kernel32.dll")] public static extern uint SetThreadExecutionState(uint e);' -Name P -Namespace W -PassThru;`,"$p::SetThreadExecutionState(0x80000000 -bor 0x00000001) | Out-Null;","[void][Console]::In.ReadToEnd();"].join(" ");ret ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L2

7`);let r=Qe("npm install -g superclawd@latest",{stdio:"inherit",shell:!0});if(r.status!==0)return process.stderr.write(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L2

8\u2717 Couldn't auto-update to ${n} (npm exited ${r.status??"?"}).

9 SuperClawd won't launch an outdated version. Update manually, then re-run:

10 npm install -g superclawd@latest

11`),{exitCode:1};let o=Qe("superclawd",t,{stdio:"inherit",env:{...process.env,SUPERCLAWD_UPDATED:"1"}});return o.error?(process.stderr.write(`

12\u2713 Updated to ${n}. Re-run your command.

13`),{exitCode:0}):{exitCode:o.status??0}}import{randomUUID as et}from"node:crypto";function tt(e){let t={"content-type":"application/json","x-mcp-key-id":e.keyId,"x-mcp-secret":e.secret,"x-workspace-slug":e.workspace,"x-request-id":et()};return process.env.SUPERCLAWD_EXPERIMENTAL==="true"&&(t["x-experimental"

141. Tests pass and cover new behavior.

152. No secrets or debug logging left in.

163. Public APIs documented.

174. Changelog updated.`}],at=[{name:"error-codes",description:"Canonical list of this platform's error codes.",content:`E1001 invalid_input

18E1002 unauthorized

19E1003 rate_limited

20E2001 upstream_unavailable`}];var ct=[{id:"workflow-deploy-001",name:"production-deploy",description:"deploying to production, cutting a release, or shipping to prod",itemCount:6,content:`Production deploy workflow:

211. Confirm CI is green on main.

222. Bump version + update changelog.

Long lines were clipped for display.

dist/mcp-server.mjsView file

Lines 1-25javascript

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

2var ey=Object.create;var di=Object.defineProperty;var ty=Object.getOwnPropertyDescriptor;var ry=Object.getOwnPropertyNames;var ny=

Source & flagged code

5 flagged · loading source

dist/index.jsView file

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L3: import{spawn as tn,spawnSync as Dr,execSync as Or}from"node:child_process";import{fileURLToPath as en}from"node:url";import{existsSync as nn}from"node:fs";import{resolve as Tr,dirn... L4: `,{mode:384});try{cn(Q,384)}catch{}}function Ne(){return P()?.preferences?.sk[redacted]===!0}function un(){return P()?.preferences?.notifications===!0}function Ge(){return P()?.... L5: `)}catch{}}function He(e,t){Ue(Be(e))||pn(e,{notifications:un(),...t?{workspace:t}:{}})}function qe(){Ue(Q)||G({credentials:{keyId:"",secret:"",workspace:""},preferences:{notificat... L6: `)};function dn(){try{switch(process.platform){case"darwin":return Se("caffeinate",["-i","-w",String(process.pid)],{stdio:"ignore"});case"linux":return Se("systemd-inhibit",["--wha...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L2

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L2

dist/mcp-server.mjsView file

5|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,L._)`+${o}`);return;case"boolean":n.elseIf((0,L._)`${o} === "false" || ${o} === 0 || ${o} === null`).as... L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,L._)`[${o}]`)}}}function tw({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,L._)`${e} !== undefined`,()=>t.assign((0,L._)`... L7: missingProperty: ${n},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/mcp-server.mjsView on unpkg · L5

Findings

4 High3 Medium7 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/mcp-server.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L2

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L2

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L2

7`);let r=Qe("npm install -g superclawd@latest",{stdio:"inherit",shell:!0});if(r.status!==0)return process.stderr.write(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L2

8\u2717 Couldn't auto-update to ${n} (npm exited ${r.status??"?"}).

9 SuperClawd won't launch an outdated version. Update manually, then re-run:

10 npm install -g superclawd@latest

11`),{exitCode:1};let o=Qe("superclawd",t,{stdio:"inherit",env:{...process.env,SUPERCLAWD_UPDATED:"1"}});return o.error?(process.stderr.write(`

12\u2713 Updated to ${n}. Re-run your command.

141. Tests pass and cover new behavior.

152. No secrets or debug logging left in.

163. Public APIs documented.

174. Changelog updated.`}],at=[{name:"error-codes",description:"Canonical list of this platform's error codes.",content:`E1001 invalid_input

18E1002 unauthorized

19E1003 rate_limited

211. Confirm CI is green on main.

222. Bump version + update changelog.

Long lines were clipped for display.

dist/mcp-server.mjsView file

Lines 1-25javascript

1import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

2var ey=Object.create;var di=Object.defineProperty;var ty=Object.getOwnPropertyDescriptor;var ry=Object.getOwnPropertyNames;var ny=