superclawd@0.1.92
Claude Code, supercharged — your team's standards, every session. The superclawd CLI loads your workspace's skills, agents, commands, workflows, and live directives into Claude Code as a plugin.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe authenticated MCP endpoint is configurable independently of the default login host, and saved credentials are sent to it without a destination allowlist. This is conditional credential exposure, not evidence of a malicious default recipient.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A user runs the CLI with a custom SUPERCLAWD_MCP_API_URL and starts an authenticated session.
Impact
Credentials could be disclosed to the operator-selected endpoint; the inspected source does not establish that an unrelated endpoint is selected by default.
Mechanism
The CLI forwards saved credentials and the configured API URL to its MCP server, which places the credentials in request headers.
AI rationale
The authenticated MCP endpoint is configurable independently of the default login host, and saved credentials are sent to it without a destination allowlist. This is conditional credential exposure, not evidence of a malicious default recipient.
Evidence
dist/index.jsdist/mcp-server.mjs
Network endpoints2
api.superclawd.commcp-api.superclawd.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI uses a configurable MCP API URL, with the SuperClawd host as its default.
- Saved credentials are passed to the MCP server and sent in authentication headers to that URL.
- The MCP server accepts the URL and credentials from environment variables and sends authenticated requests to it.
- The flagged login caller runs only when the user invokes the login command; login exchanges a device code and saves credentials after approval.
Evidence against
- The device-login flow displays a verification code and reports browser denial or expiration; its requests carry device-login data rather than saved MCP credentials.
Behavioral surface
ChildProcessEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
NoLicense
Source & flagged code
10 flaggeddist/index.jsView file
2Source sends the broad process environment to a literal external destination.
L2: import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);
L3: var Xe=["opus","fable","sonnet","haiku"],Dn={opus:"claude-opus-5-5",fable:"claude-fable-5-1",sonnet:"claude-sonnet-5-5",haiku:"claude-haiku-5-5"},Tn=/^claude-(opus|fable|sonnet|hai...
L4: `,{mode:384});try{Yn(oe,384)}catch{}}function nt(){return L()?.preferences?.sk[redacted]===!0}function Bn(){return L()?.preferences?.notifications===!0}function rt(){return L()?...
L5: `)}catch{}}function ct(e,t,n=!1){et(lt(e))||Hn(e,{notifications:n?!1:Bn(),...t?{workspace:t}:{}})}function ut(){et(oe)||G({credentials:{keyId:"",secret:"",workspace:""},preferences...
L6: `)};function qn(){try{switch(process.platform){case"darwin":return
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/index.jsView on unpkg · L2•matchType = previous_version_dangerous_delta
matchedPackage = superclawd@0.1.91
matchedIdentity = npm:c3VwZXJjbGF3ZA:0.1.91
similarity = 0.667
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/index.jsView on unpkgFindings
2 Critical7 High3 Medium7 Low
CriticalHardcoded Runtime Data Exfiltrationdist/index.js
CriticalPrevious Version Dangerous Deltadist/index.js
HighChild Processdist/index.js
HighShelldist/index.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/index.js
HighTrigger Reachable Command Output Exfiltrationdist/index.js
HighSemantic Analysis Limiteddist/hook-helper.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
Low
Affected versions and remediation
This report applies to superclawd@0.1.92.
See all versions of superclawd for other recorded verdicts.
- Review the evidence and your use of superclawd@0.1.92 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.