visionclaw@0.1.205

⚠ Under review

A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 351 file(s), 3.46 MB of source, external domains: 0.0.0.0, 127.0.0.1, 9r.gru.ai, accounts.google.com, admin.googleapis.com, api.anthropic.com, api.openai.com, api.telegram.org, avatars.githubusercontent.com, bot.sannysoft.com, bots.qq.com, chocolatey.org, clients2.google.com, cloudflare-dns.com, console.cloud.google.com, discord.com, drive.google.com, feross.org, files.catbox.moe, financial-tool.visionclaw.dev, github.com, huggingface.co, ilinkai.weixin.qq.com, jimmy.warting.se, licensing.googleapis.com, mcp.serpapi.com, novac2c.cdn.weixin.qq.com, onboarding.visionclaw.dev, r.jina.ai, registry.npmjs.org, screenshots.tos-accelerate.volces.com, serpapi.com, serpapi.visionclaw.workers.dev, sms.visionclaw.dev, t.me, telegram.org, unpkg.com, visionclaw.dev, www.apache.org, www.apple.com, www.google.com, www.googleapis.com

Oversized source lightweight scan

dist-agent/bundle.cjs55.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCrypto

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup-openclaw-shim.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist-agent/playwriter-relay.cjsView file

5var import_node_fs = require("node:fs"); L6: var import_node_child_process = require("node:child_process"); L7: var import_node_os = require("node:os");

High

Child Process

Package source references child process execution.

dist-agent/playwriter-relay.cjsView on unpkg · L5

3// dist/entry/playwriter-relay.js L4: var import_playwriter = require("playwriter"); L5: var import_node_fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-agent/playwriter-relay.cjs

Findings

1 Critical7 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/onboarding/setup-shared.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-agent/playwriter-relay.cjs

HighShelldist/tools/upgrade.js

HighSame File Env Network Executiondist/tools/android-executor.js

HighRuntime Package Installdist/data-processing/batch-process.js

HighShips High Entropy Blobdist-agent/realtime/assets/samples/coral.mp3

HighOversized Source Filedist-agent/bundle.cjs

MediumDynamic Requiredist-agent/playwriter-relay.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistence

Affected versions and remediation

This report applies to visionclaw@0.1.205.

See all versions of visionclaw for other recorded verdicts.

Review the evidence and your use of visionclaw@0.1.205 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-12 09:57:57.848Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / visionclaw / 0.1.205

visionclaw@0.1.205

⚠ Under review

A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Oversized source lightweight scan

dist-agent/bundle.cjs55.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCrypto

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup-openclaw-shim.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist-agent/playwriter-relay.cjsView file

5var import_node_fs = require("node:fs"); L6: var import_node_child_process = require("node:child_process"); L7: var import_node_os = require("node:os");

High

Child Process

Package source references child process execution.

dist-agent/playwriter-relay.cjsView on unpkg · L5

3// dist/entry/playwriter-relay.js L4: var import_playwriter = require("playwriter"); L5: var import_node_fs = require("node:fs");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-agent/playwriter-relay.cjs

Findings

1 Critical7 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/onboarding/setup-shared.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-agent/playwriter-relay.cjs

HighShelldist/tools/upgrade.js

HighSame File Env Network Executiondist/tools/android-executor.js

HighRuntime Package Installdist/data-processing/batch-process.js

HighShips High Entropy Blobdist-agent/realtime/assets/samples/coral.mp3

HighOversized Source Filedist-agent/bundle.cjs

MediumDynamic Requiredist-agent/playwriter-relay.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistence

Affected versions and remediation

This report applies to visionclaw@0.1.205.

See all versions of visionclaw for other recorded verdicts.

Review the evidence and your use of visionclaw@0.1.205 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-12 09:57:57.848Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.