superclawd@0.1.91
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe source confirms authenticated requests can send saved credentials to an unrestricted SUPERCLAWD_MCP_API_URL override, warranting a warning for conditional exposure. The first-party default and absence of evidence that an alternate endpoint was used do not establish malicious behavior.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Run the CLI with credentials saved and SUPERCLAWD_MCP_API_URL set to an alternate endpoint.
Impact
An alternate endpoint can receive the saved credentials. The inspected source does not establish that an alternate endpoint was used or that credentials reached an unrelated recipient.
Mechanism
The CLI passes the configured URL and saved key and secret to its MCP server; requests attach those values as authentication headers without a destination allowlist.
AI rationale
The source confirms authenticated requests can send saved credentials to an unrestricted SUPERCLAWD_MCP_API_URL override, warranting a warning for conditional exposure. The first-party default and absence of evidence that an alternate endpoint was used do not establish malicious behavior.
Evidence
dist/index.jsdist/mcp-server.mjs
Network endpoints1
mcp-api.superclawd.com
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI obtains credentials through browser-approved device authorization and then saves them locally.
- The MCP API defaults to SuperClawd’s service, but SUPERCLAWD_MCP_API_URL can replace that destination.
- The runtime forwards saved credentials in authentication headers to requests using the configurable MCP API URL, without checking the destination against an allowlist.
- The inspected CLI locations show the login and normal command dispatch paths; they do not establish that an alternate endpoint was configured.
Evidence against
- The inspected default destination is the package’s first-party MCP service, and the source does not show credentials sent to an unrelated fixed recipient.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
9 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: var Xe=["opus","fable","sonnet","haiku"],Dn={opus:"claude-opus-5-5",fable:"claude-fable-5-1",sonnet:"claude-sonnet-5-5",haiku:"claude-haiku-5-5"},Tn=/^claude-(opus|fable|sonnet|hai...
L4: `,{mode:384});try{Gn(oe,384)}catch{}}function nt(){return L()?.preferences?.sk[redacted]===!0}function Kn(){return L()?.preferences?.notifications===!0}function rt(){return L()?...
L5: `)}catch{}}function ct(e,t,n=!1){et(lt(e))||Bn(e,{notifications:n?!1:Kn(),...t?{workspace:t}:{}})}function ut(){et(oe)||G({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function Hn(){try{switch(process.platform){case"darwin":return
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L22import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: var Xe=["opus","fable","sonnet","haiku"],Dn={opus:"claude-opus-5-5",fable:"claude-fable-5-1",sonnet:"claude-sonnet-5-5",haiku:"claude-haiku-5-5"},Tn=/^claude-(opus|fable|sonnet|hai...
L4: `,{mode:384});try{Gn(oe,384)}catch{}}function nt(){return L()?.preferences?.sk[redacted]===!0}function Kn(){return L()?.preferences?.notifications===!0}function rt(){return L()?...
High
Findings
1 Critical7 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
Affected versions and remediation
This report applies to superclawd@0.1.91.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.91 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.