superclawd@0.1.86
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThere is no automatic npm lifecycle trigger or self-dependent release chain, so blocking is not supported. However, the explicit CLI command creates persistent project hooks and transmits prompt- and repository-derived information to a remote service, which warrants a warning.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
A user runs superclawd in a Git project and then uses Claude Code or commits changes.
Impact
Project change metadata and portions of prompts can leave the machine; remotely supplied directives can influence the launched AI agent.
Mechanism
Persistent Git and Claude Code hooks with remote memory and directive retrieval.
AI rationale
There is no automatic npm lifecycle trigger or self-dependent release chain, so blocking is not supported. However, the explicit CLI command creates persistent project hooks and transmits prompt- and repository-derived information to a remote service, which warrants a warning.
Evidence
dist/index.jsdist/hook-helper.mjs.git/hooks/post-commit.superclawd/config.json.claude-plugin/plugin.json
Network endpoints2
mcp-api.superclawd.comapi.superclawd.com
Decision evidence
public snapshotAI called this Suspicious at 89.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The normal CLI path installs a Git post-commit hook in the current project.
- That hook reads the committed Git patch and reports derived results to the vendor API.
- Session hooks send up to 500 characters of user prompts to the vendor memory-search endpoint.
- The CLI creates a Claude Code plugin that loads remote directives and registers hooks.
Evidence against
- package.json has no preinstall, install, or postinstall hook.
- The behavior is reached when the user runs the superclawd CLI, not when npm installs it.
- The source uses named SuperClawd API hosts and authenticated service requests rather than an opaque payload host.
- No runtime dependency on superclawd itself is declared.
Behavioral surface
EnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
7 flaggeddist/mcp-server.mjsView file
5|| (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,L._)`+${o}`);return;case"boolean":n.elseIf((0,L._)`${o} === "false" || ${o} === 0 || ${o} === null`).as...
L6: || ${i} === "boolean" || ${o} === null`).assign(a,(0,L._)`[${o}]`)}}}function tw({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,L._)`${e} !== undefined`,()=>t.assign((0,L._)`...
L7: missingProperty: ${n},
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/mcp-server.mjsView on unpkg · L5dist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: import{spawn as fn,spawnSync as zr,execSync as Qr}from"node:child_process";import{fileURLToPath as dn}from"node:url";import{existsSync as mn}from"node:fs";import{resolve as Zr,dirn...
L4: `,{mode:384});try{kn(ee,384)}catch{}}function Ye(){return A()?.preferences?.sk[redacted]===!0}function En(){return A()?.preferences?.notifications===!0}function Be(){return A()?...
L5: `)}catch{}}function ze(e,t,n=!1){Fe(Xe(e))||Cn(e,{notifications:n?!1:En(),...t?{workspace:t}:{}})}function Qe(){Fe(ee)||G({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function Rn(){try{switch(process.platform){case"darwin":return
Critical
Findings
1 Critical5 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/mcp-server.mjs
LowFilesystem
Low
Affected versions and remediation
This report applies to superclawd@0.1.86.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.86 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.