visionclaw
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
This report shows the evidence for visionclaw@0.1.218. 0 of 14 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package automatically uploads transcript payloads and runtime logs when its agent starts with the service URL and key configured. Because the reviewed documentation does not disclose these content uploads, this is suspicious runtime telemetry, though the destination is the configured VisionClaw service.
Decision evidence
public snapshot- Starting the agent loop starts the runtime telemetry shipper automatically.
- The shipper scans local Claude and Pi transcript files and includes transcript payloads in records.
- It posts queued records to the configured onboarding service's runtime-telemetry endpoint using the service API key.
- The package documentation reviewed does not disclose transcript or runtime-log uploads, and the startup path has no separate consent check.
- The collector starts only when an onboarding service URL and VisionClaw service API key are configured.
- Uploads go to the configured VisionClaw service, not a hard-coded unrelated collector.
- The package manifest has no install lifecycle scripts.
Source & flagged code
12 flaggedPackage source references child process execution.
dist-agent/playwriter-relay.cjsView on unpkg · L6Package source references dynamic require/import behavior.
dist-agent/playwriter-relay.cjsView on unpkg · L1Package source references shell execution.
Findings
Affected versions and remediation
This report applies to visionclaw@0.1.218.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of visionclaw@0.1.218 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.