registry / visionclaw / 0.1.213
visionclaw@0.1.213
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is not concrete malicious install-hook behavior, but it automatically changes a browser-agent extension surface and conditionally alters policy configuration. Downgrade to a warning for the guarded first-party extension lifecycle risk.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
Running the package's macOS browser backend.
Impact
A local automation profile gains a browser extension; privileged cleanup may alter matching Chrome policy configuration.
Mechanism
Automatic browser-extension setup and legacy policy cleanup.
AI rationale
This is not concrete malicious install-hook behavior, but it automatically changes a browser-agent extension surface and conditionally alters policy configuration. Downgrade to a warning for the guarded first-party extension lifecycle risk.
Evidence
dist/onboarding/playwriter-extension.jsdist/agent/runtime-surface.js/Library/Managed Preferences/com.google.Chrome.plist
Network endpoints1
clients2.google.com/service/update2/crx
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.
Evidence for warning
- The postinstall hook modifies the installed dependency tree.
- Runtime detection automatically configures a Chrome extension in a dedicated automation profile.
- The extension cleanup can invoke sudo to remove matching Chrome enterprise-policy entries.
Evidence against
- The postinstall code copies only a bundled local shim and makes no network request.
- The extension setup is limited to macOS and a package-owned automation profile.
- No runtime dependency on visionclaw itself is declared.
- Workspace API calls use credentials supplied in the workspace configuration and target Google APIs.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
14 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/setup-openclaw-shim.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist-agent/playwriter-relay.cjsView file
6var import_node_fs = require("node:fs");
L7: var import_node_child_process = require("node:child_process");
L8: var import_node_module = require("node:module");
High
Child Process
Package source references child process execution.
dist-agent/playwriter-relay.cjsView on unpkg · L6dist/tools/upgrade.jsView file
11import { writePendingUpgrade } from "../config/index.js";
L12: const execAsync = promisify(exec);
L13: const execFileAsync = promisify(execFile);
Findings
2 Critical7 High7 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationdist/onboarding/provision-workspace-account.js
CriticalPrevious Version Dangerous Deltadist/agent/browser-launcher.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist-agent/playwriter-relay.cjs
HighShelldist/tools/upgrade.js
HighSame File Env Network Executiondist/tools/android-executor.js
HighSandbox Evasion Gated Capabilitydist/obs/tunnel.js#virtual:normalized:round1
HighRuntime Package Installdist/data-processing/batch-process.js
HighSemantic Analysis Limiteddist/agent/data-collector.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
Affected versions and remediation
This report applies to visionclaw@0.1.213.
See all versions of visionclaw for other recorded verdicts.
- Review the evidence and your use of visionclaw@0.1.213 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.