registry / visionclaw / 0.1.208
visionclaw@0.1.208
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection does not support the scanner's malicious verdict. The automatic browser-extension lifecycle and self-updater warrant a warning under the extension-risk policy, not a publication block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Starting VisionClaw on macOS invokes browser-backend detection; explicit upgrade action invokes self-update.
Impact
Creates a profile-scoped extension install source and may request sudo for narrowly targeted legacy cleanup.
Mechanism
first-party browser-extension lifecycle setup and self-upgrade
AI rationale
Source inspection does not support the scanner's malicious verdict. The automatic browser-extension lifecycle and self-updater warrant a warning under the extension-risk policy, not a publication block.
Evidence
package.jsonscripts/setup-openclaw-shim.mjsdist/agent/runtime-surface.jsdist/onboarding/playwriter-extension.jsdist/tools/upgrade.jsdist-agent/playwriter-relay.cjsnode_modules/openclaw~/.visionclaw/.playwriter-chrome/External Extensions/jfeammnjpkecdekppnclgkkffahnhfhe.json/Library/Managed Preferences/com.google.Chrome.plist~/.visionclaw/agent/bundle.cjs
Network endpoints2
clients2.google.com/service/update2/crx127.0.0.1:19988
Decision evidence
public snapshotAI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- package.json postinstall runs scripts/setup-openclaw-shim.mjs.
- dist/agent/runtime-surface.js automatically calls ensurePlaywriterExtension() on macOS startup.
- dist/onboarding/playwriter-extension.js writes a Chrome External Extensions JSON and can invoke sudo to remove legacy policy entries.
- dist/tools/upgrade.js can download and replace a self-managed bundle, then run pnpm/npm install.
Evidence against
- Postinstall only copies the bundled local OpenClaw SDK shim into this package's node_modules.
- Extension JSON is scoped to ~/.visionclaw/.playwriter-chrome, not normal Chrome.
- Legacy policy cleanup targets only the package's fixed Playwriter extension ID.
- Observed relay defaults to localhost; no credential-harvesting or covert exfiltration chain was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/setup-openclaw-shim.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist-agent/playwriter-relay.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = visionclaw@0.1.202
matchedIdentity = npm:dmlzaW9uY2xhdw:0.1.202
similarity = 0.642
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-agent/playwriter-relay.cjsView on unpkg6var import_node_fs = require("node:fs");
L7: var import_node_child_process = require("node:child_process");
L8: var import_node_module = require("node:module");
Findings
1 Critical7 High8 Medium5 Low
CriticalPrevious Version Dangerous Deltadist-agent/playwriter-relay.cjs
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist-agent/playwriter-relay.cjs
HighShelldist/tools/upgrade.js
HighSame File Env Network Executiondist/tools/android-executor.js
HighSandbox Evasion Gated Capabilitydist/onboarding/bootstrap-client.js
HighRuntime Package Installdist/data-processing/batch-process.js
HighShips High Entropy Blobdist-agent/realtime/assets/samples/coral.mp3
MediumDynamic Requiredist-agent/playwriter-relay.cjs
MediumNetwork
MediumEnvironment Vars
Medium
Affected versions and remediation
This report applies to visionclaw@0.1.208.
See all versions of visionclaw for other recorded verdicts.
- Review the evidence and your use of visionclaw@0.1.208 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.