other
Warning
- Location
openclaw.plugin.json:7- Finding
Declared Plugin Runtime Is Missing from the Distributed Package
- Content
View full analysis
Vulnerability Details
File Location:
openclaw.plugin.json:7-9
Corroborating Locations:package.json:7-11,package.json:13-16,SKILL.md:48-60
Vulnerability Type: Incomplete or misleading plugin package
Risk Level: MediumVulnerable Code
openclaw.plugin.json:7-9:json "runtime": { "entry": "./dist/index.js" },package.json:7-11:json "type": "module", "main": "./dist/index.js", "exports": "./dist/index.js", "scripts": { "test": "node --test" },package.json:13-16:json "openclaw": { "extensions": [ "./dist/index.js" ] },SKILL.md:48-60:markdown ## First step: verify or install the plugin 1. Check whether the plugin is already available: ```bash openclaw reverse --help- If the command is missing, install the plugin from this skill bundle:
bash openclaw plugins install -l "{baseDir}"text ### Technical Analysis Both plugin manifests declare `./dist/index.js` as the executable runtime entry point. However, the audited package inventory contains only: - `SKILL.md` - `openclaw.plugin.json` - `package.json` The declared `dist/index.js` file and the entire `dist` directory are absent. The documentation nevertheless instructs users to install the local package and states that the plugin files are available in the skill bundle. Because the executable implementation is missing, none of the advertised checkpoint, rollback, workspace-restoration, session-inspection, or branching behavior can be verified or executed from the supplied artifact. This is primarily a package-integrity and availability defect rather than evidence of malicious runtime behavior. The absent runtime also prevents review of security-sensitive operations described by the documentation, including filesystem restoration, configuration modification, session rollback, child-agent creation, and authentication cloning. Their safety cannot be established from the distributed files. ### Attack Path 1 ...[truncated 1271 chars]- Remediation
View remediation
Remediation Suggestions
- Include the complete
dist/index.jsruntime and every transitive local file required by it in the distributed package. - Add a release-time validation step that fails packaging when any path declared by
runtime.entry,main,exports, oropenclaw.extensionsis missing. - Test installation and command execution from the exact final release artifact rather than from a development checkout.
- Publish the corresponding reviewable source code and reproducible build instructions for the generated runtime.
- Cryptographically sign or checksum release artifacts so users can verify that the reviewed source corresponds to the distributed package.
- Add an installation-time integrity check before modifying OpenClaw configuration or registering the plugin.
- Remove or clearly qualify installation and setup instructions until the runtime is present and its behavior has undergone security review.
- Add automated smoke tests covering plugin loading,
openclaw reverse --help, setup, rollback safeguards, workspace path validation, and authentication-cloning behavior.
- Include the complete