visionclaw@0.1.215
A personal assistant agent that runs on your desktop, receives commands from messaging channels, and executes tasks autonomously.
AI Security Review
scanned 17d ago · by lpm-firewall-aiThe source confirms remote-command-triggered collection and upload of sensitive local data without a separate local confirmation. Because the default destination is product-aligned and the source does not establish an unrelated recipient, classify this as a warning rather than a block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The heartbeat response contains a pending data collection command.
Impact
Private logs, transcripts, and workspace files can leave the machine without a separate local confirmation in this command path.
Mechanism
The handler archives local data and uploads it to TOS using resolved credentials and a configured storage destination.
AI rationale
The source confirms remote-command-triggered collection and upload of sensitive local data without a separate local confirmation. Because the default destination is product-aligned and the source does not establish an unrelated recipient, classify this as a warning rather than a block.
Evidence
dist/agent/heartbeat-manager.jsdist/agent/command-dispatcher.jsdist/agent/data-collector.jsdist/tos-credentials.jsdist/tos-storage.jslogstranscriptsconfig.jsonmcp-servers.jsonowner.jsonsession.json
Network endpoints1
tos-accelerate.volces.com
Decision evidence
public snapshotAI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The heartbeat manager registers a data collection handler and dispatches commands returned by the service.
- The handler collects logs, transcripts, and workspace files, including configuration and session files, then uploads archives using resolved TOS credentials.
- The collector uses a named VisionClaw storage bucket and the configured TOS endpoint; its configuration can also supply a per-agent storage override.
- The inspected restart operation re-executes the current program with its existing arguments and environment.
Evidence against
- Collection requires a pending service command; the inspected source does not establish an unrelated recipient or install-time trigger.
- The collector's default bucket and endpoint are product-aligned, though the endpoint can be overridden in configuration.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Source & flagged code
11 flaggeddist-agent/playwriter-relay.cjsView file
•matchType = previous_version_dangerous_delta
matchedPackage = visionclaw@0.1.213
matchedIdentity = npm:dmlzaW9uY2xhdw:0.1.213
similarity = 0.525
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-agent/playwriter-relay.cjsView on unpkg6var import_node_fs = require("node:fs");
L7: var import_node_child_process = require("node:child_process");
L8: var import_node_module = require("node:module");
High
Child Process
Package source references child process execution.
dist-agent/playwriter-relay.cjsView on unpkg · L6dist/tools/upgrade.jsView file
11import { writePendingUpgrade } from "../config/index.js";
L12: const execAsync = promisify(exec);
L13: const execFileAsync = promisify(execFile);
Findings
1 Critical6 High7 Medium4 Low
CriticalPrevious Version Dangerous Deltadist-agent/playwriter-relay.cjs
HighChild Processdist-agent/playwriter-relay.cjs
HighShelldist/tools/upgrade.js
HighSame File Env Network Executiondist/utils/playwriter-relay.js#virtual:normalized:round1
HighSandbox Evasion Gated Capabilitydist/onboarding/bootstrap-client.js
HighRuntime Package Installdist/data-processing/batch-process.js
HighSemantic Analysis Limiteddist/agent/data-collector.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/agent/data-collector.js
MediumShips Build Helperdist/builtin-skills/catalog/phone-adb-automation/phone_launch.sh
Affected versions and remediation
This report applies to visionclaw@0.1.215.
See all versions of visionclaw for other recorded verdicts.
- Review the evidence and your use of visionclaw@0.1.215 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.