API Logger

• Analyzed: May 11, 2026, 5:57 AM
• Findings: 1
• Version: 1.2.0
• Hash: 0849beeccb9fd175fa3cb9d5d4dc3261946246fb7562825be5362f60df028f42
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle implements a Man-in-the-Middle (MitM) proxy (`proxy.py`) designed to intercept and log all LLM API traffic, including full prompts and responses. It includes an installation script (`install.sh`) that establishes persistence on macOS via a LaunchAgent and provides instructions to redirect the OpenClaw agent's communication through this local proxy. While the proxy includes a benign feature to mask API keys, the code contains hardcoded absolute paths to a specific user directory (`/Users/xm_plus/`) in `log_viewer.py` and `proxy.py`, and includes functionality to send logged data to an external platform (Feishu). The combination of traffic interception, persistence, and environment-specific hardcoding presents a significant security risk, although it lacks clear evidence of intentional malice beyond its stated debugging purpose.