visionclaw@0.1.210

⚠ Under review

A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 421 file(s), 4.04 MB of source, external domains: 0.0.0.0, 127.0.0.1, accounts.google.com, admin.googleapis.com, api.anthropic.com, api.openai.com, api.sgroup.qq.com, api.telegram.org, avatars.githubusercontent.com, bot.sannysoft.com, bots.qq.com, chocolatey.org, clients2.google.com, cloudflare-dns.com, console.cloud.google.com, discord.com, files.catbox.moe, financial-tool.visionclaw.dev, github.com, huggingface.co, ilinkai.weixin.qq.com, licensing.googleapis.com, mcp.serpapi.com, novac2c.cdn.weixin.qq.com, onboarding.visionclaw.dev, r.jina.ai, registry.npmjs.org, screenshots.tos-accelerate.volces.com, serpapi.com, serpapi.visionclaw.workers.dev, sms.visionclaw.dev, t.me, telegram.org, unpkg.com, visionclaw.dev, www.apple.com, www.google.com, www.googleapis.com

Oversized source lightweight scan

dist-agent/bundle.cjs56.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup-openclaw-shim.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist-agent/playwriter-relay.cjsView file

6var import_node_fs = require("node:fs"); L7: var import_node_child_process = require("node:child_process"); L8: var import_node_module = require("node:module");

High

Child Process

Package source references child process execution.

dist-agent/playwriter-relay.cjsView on unpkg · L6

1const __importMetaUrl=require('url').pathToFileURL(__filename).href; L2: "use strict";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-agent/playwriter-relay.cjs

Findings

1 Critical7 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/agent/browser-launcher.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-agent/playwriter-relay.cjs

HighShelldist/tools/upgrade.js

HighSame File Env Network Executiondist/tools/android-executor.js

HighSandbox Evasion Gated Capabilitydist/onboarding/bootstrap-client.js

HighRuntime Package Installdist/data-processing/batch-process.js

HighSemantic Analysis Limiteddist/factcheck/store.js

MediumDynamic Requiredist-agent/playwriter-relay.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistence

Affected versions and remediation

This report applies to visionclaw@0.1.210.

See all versions of visionclaw for other recorded verdicts.

Review the evidence and your use of visionclaw@0.1.210 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-20 11:19:01.809Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / visionclaw / 0.1.210

visionclaw@0.1.210

⚠ Under review

A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 21 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Oversized source lightweight scan

dist-agent/bundle.cjs56.0 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoHighEntropyStrings

Source & flagged code

14 flagged

package.jsonView file

•scripts.postinstall = node scripts/setup-openclaw-shim.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

dist-agent/playwriter-relay.cjsView file

6var import_node_fs = require("node:fs"); L7: var import_node_child_process = require("node:child_process"); L8: var import_node_module = require("node:module");

High

Child Process

Package source references child process execution.

dist-agent/playwriter-relay.cjsView on unpkg · L6

1const __importMetaUrl=require('url').pathToFileURL(__filename).href; L2: "use strict";

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist-agent/playwriter-relay.cjs

Findings

1 Critical7 High8 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/agent/browser-launcher.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist-agent/playwriter-relay.cjs

HighShelldist/tools/upgrade.js

HighSame File Env Network Executiondist/tools/android-executor.js

HighSandbox Evasion Gated Capabilitydist/onboarding/bootstrap-client.js

HighRuntime Package Installdist/data-processing/batch-process.js

HighSemantic Analysis Limiteddist/factcheck/store.js

MediumDynamic Requiredist-agent/playwriter-relay.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistence

Affected versions and remediation

This report applies to visionclaw@0.1.210.

See all versions of visionclaw for other recorded verdicts.

Review the evidence and your use of visionclaw@0.1.210 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-20 11:19:01.809Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.