registry / superclawd / 0.1.67
superclawd@0.1.67
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe code establishes an explicit-user-command agent extension with transcript capture, remote memory processing, and optional Git-hook persistence. It does not meet the policy threshold for malicious install-hook abuse because npm installation itself has no install-time trigger.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs the superclawd CLI to launch Claude Code in a repository.
Impact
Repository and agent-session content can be processed remotely, and a repository Git hook can persist after the CLI run.
Mechanism
Claude plugin hooks capture transcripts and send derived memory data to the SuperClawd service.
AI rationale
The code establishes an explicit-user-command agent extension with transcript capture, remote memory processing, and optional Git-hook persistence. It does not meet the policy threshold for malicious install-hook abuse because npm installation itself has no install-time trigger.
Evidence
dist/index.jsdist/hook-helper.mjs~/.superclawd/sessions/<id>/plugin<repository>/.git/hooks/post-commit
Network endpoints1
mcp-api.superclawd.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-run CLI generates a Claude Code plugin with hooks for session events and tool use.
- Those hooks read Claude transcript paths and process session and agent transcripts in detached background tasks.
- The CLI can add a post-commit hook that runs the package helper after commits.
- The helper sends authenticated requests to the SuperClawd MCP service and stores learned memories remotely.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle script is prepublishOnly.
- The extension and hooks are reached by an explicit superclawd command, not npm installation.
- The generated plugin is placed in a package-owned session directory and is passed to Claude with --plugin-dir.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
8 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: import{spawn as fn,spawnSync as zr,execSync as Qr}from"node:child_process";import{fileURLToPath as dn}from"node:url";import{existsSync as mn}from"node:fs";import{resolve as Zr,dirn...
L4: `,{mode:384});try{kn(ee,384)}catch{}}function Ye(){return A()?.preferences?.sk[redacted]===!0}function En(){return A()?.preferences?.notifications===!0}function Be(){return A()?...
L5: `)}catch{}}function ze(e,t,n=!1){Fe(Xe(e))||Cn(e,{notifications:n?!1:En(),...t?{workspace:t}:{}})}function Qe(){Fe(ee)||G({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function Rn(){try{switch(process.platform){case"darwin":return
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: import{spawn as fn,spawnSync as zr,execSync as Qr}from"node:child_process";import{fileURLToPath as dn}from"node:url";import{existsSync as mn}from"node:fs";import{resolve as Zr,dirn...
L4: `,{mode:384});try{kn(ee,384)}catch{}}function Ye(){return A()?.preferences?.sk[redacted]===!0}function En(){return A()?.preferences?.notifications===!0}function Be(){return A()?...
High
Findings
1 Critical6 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp-server.mjs
Affected versions and remediation
This report applies to superclawd@0.1.67.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.67 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.