registry / superclawd / 0.1.85
superclawd@0.1.85
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe package has no registry install-time trigger, so the stricter install-hook block rule does not apply. Its explicit CLI nevertheless installs persistent hooks that process session and commit data, which warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Running the superclawd CLI in a Git repository with an authenticated workspace.
Impact
Repository diffs and Claude session content can be processed after the initial CLI invocation; the Git hook persists until replaced or removed.
Mechanism
Persistent Claude and Git hooks capture session and commit context for remote memory processing.
AI rationale
The package has no registry install-time trigger, so the stricter install-hook block rule does not apply. Its explicit CLI nevertheless installs persistent hooks that process session and commit data, which warrants a warning.
Evidence
dist/index.jsdist/hook-helper.mjs.git/hooks/post-commit
Network endpoints1
mcp-api.superclawd.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The explicit CLI run installs Claude hooks that capture session-end events.
- The helper reads Claude transcript files and processes their contents for memory capture.
- A normal CLI launch also installs a persistent Git post-commit hook in the current repository.
- The post-commit helper reads the committed diff and contacts the package service.
Evidence against
- package.json has no preinstall, install, or postinstall hook; its only lifecycle entry is prepublishOnly.
- The control-surface writes occur after the user runs the superclawd CLI, not while npm installs the package.
- The network calls use the package's configured SuperClawd service and authenticated workspace credentials.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/mcp-server.mjsView file
5|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,L._)`+${o}`);return;case"boolean":n.elseIf((0,L._)`${o} === "false" || ${o} === 0 || ${o} === null`).as...
L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,L._)`[${o}]`)}}}function tw({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,L._)`${e} !== undefined`,()=>t.assign((0,L._)`...
L7: missingProperty: ${n},
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/mcp-server.mjsView on unpkg · L5dist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: import{spawn as fn,spawnSync as zr,execSync as Qr}from"node:child_process";import{fileURLToPath as dn}from"node:url";import{existsSync as mn}from"node:fs";import{resolve as Zr,dirn...
L4: `,{mode:384});try{kn(ee,384)}catch{}}function Ye(){return A()?.preferences?.sk[redacted]===!0}function En(){return A()?.preferences?.notifications===!0}function Be(){return A()?...
L5: `)}catch{}}function ze(e,t,n=!1){Fe(Xe(e))||Cn(e,{notifications:n?!1:En(),...t?{workspace:t}:{}})}function Qe(){Fe(ee)||G({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function Rn(){try{switch(process.platform){case"darwin":return
Critical
Findings
1 Critical5 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp-server.mjs
LowFilesystem
Low
Affected versions and remediation
This report applies to superclawd@0.1.85.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.85 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.