visionclaw@0.1.212
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiNo concrete install-time malware chain, stealth payload, or unconsented broad agent-control mutation was found. However, the package exposes powerful remote-agent and data-upload capabilities with authorization enforced outside the inspected source.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
A configured agent command such as collect_data, or an explicit visionclaw setup flow.
Impact
A configured operator or compromised command channel could cause collection and external upload of agent logs, transcripts, and workspace data.
Mechanism
Remote agent control, local data collection, and configured cloud upload.
AI rationale
No concrete install-time malware chain, stealth payload, or unconsented broad agent-control mutation was found. However, the package exposes powerful remote-agent and data-upload capabilities with authorization enforced outside the inspected source.
Evidence
dist/agent/data-collector.jsdist/onboarding/bootstrap-client.jsdist/onboarding/provision-workspace-account.js
Network endpoints1
onboarding.visionclaw.dev
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The install hook copies a bundled shim into node_modules automatically.
- A collect_data command packages logs, transcripts, and workspace data for upload to TOS.
- Bootstrap sends a machine serial number, hostname, model, OS version, and time zone to the package service.
- Workspace provisioning accepts a service-account private key and can create or reset managed Google users.
Evidence against
- The install hook is a transparent local compatibility shim; it does not download or execute remote code.
- Sensitive network actions are in explicit setup or command paths, not the install hook.
- The local relay binds to 127.0.0.1 by default and refuses to run without an extension configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/setup-openclaw-shim.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist-agent/playwriter-relay.cjsView file
6var import_node_fs = require("node:fs");
L7: var import_node_child_process = require("node:child_process");
L8: var import_node_module = require("node:module");
High
Child Process
Package source references child process execution.
dist-agent/playwriter-relay.cjsView on unpkg · L6dist/tools/upgrade.jsView file
11import { writePendingUpgrade } from "../config/index.js";
L12: const execAsync = promisify(exec);
L13: const execFileAsync = promisify(execFile);
Findings
2 Critical7 High7 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/onboarding/provision-workspace-account.js
CriticalPrevious Version Dangerous Deltadist/onboarding/windows-permissions.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist-agent/playwriter-relay.cjs
HighShelldist/tools/upgrade.js
HighSame File Env Network Executiondist/tools/android-executor.js
HighSandbox Evasion Gated Capabilitydist/obs/tunnel.js#virtual:normalized:round1
HighRuntime Package Installdist/data-processing/batch-process.js
HighSemantic Analysis Limiteddist/agent/data-collector.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to visionclaw@0.1.212.
See all versions of visionclaw for other recorded verdicts.
- Review the evidence and your use of visionclaw@0.1.212 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.