codegate-ai 0.14.4 → 0.15.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -0,0 +1,96 @@
|
|
|
1
|
+
{
|
|
2
|
+
"tool": "openclaw",
|
|
3
|
+
"version_range": ">=0.1.0",
|
|
4
|
+
"config_paths": [
|
|
5
|
+
{
|
|
6
|
+
"path": ".openclaw/openclaw.json",
|
|
7
|
+
"scope": "user",
|
|
8
|
+
"format": "jsonc",
|
|
9
|
+
"risk_surface": ["agent_config", "channel_bindings", "provider_credentials", "mcp_config"],
|
|
10
|
+
"fields_of_interest": {
|
|
11
|
+
"agents": "agent definitions and the messaging channels they expose",
|
|
12
|
+
"providers": "configured LLM providers (API keys, custom base URLs)",
|
|
13
|
+
"channels": "enabled inbound/outbound channels (whatsapp, telegram, signal, slack, imessage, discord, line, matrix, teams, zalo, voice)",
|
|
14
|
+
"mcpServers": "MCP servers exposed to the agent",
|
|
15
|
+
"tools": "plugin-provided tools registered on the agent"
|
|
16
|
+
}
|
|
17
|
+
},
|
|
18
|
+
{
|
|
19
|
+
"path": ".openclaw/custom.json",
|
|
20
|
+
"scope": "user",
|
|
21
|
+
"format": "jsonc",
|
|
22
|
+
"risk_surface": ["agent_config", "user_override"]
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"path": ".openclaw/hooks.json5",
|
|
26
|
+
"scope": "user",
|
|
27
|
+
"format": "text",
|
|
28
|
+
"risk_surface": ["hooks", "command_exec", "consent_bypass"],
|
|
29
|
+
"fields_of_interest": {
|
|
30
|
+
"pre": "pre-tool-use shell commands (runs with agent privileges)",
|
|
31
|
+
"post": "post-tool-use shell commands"
|
|
32
|
+
}
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"path": ".openclaw/exec-approvals.json",
|
|
36
|
+
"scope": "user",
|
|
37
|
+
"format": "jsonc",
|
|
38
|
+
"risk_surface": ["consent_bypass", "command_exec"],
|
|
39
|
+
"fields_of_interest": {
|
|
40
|
+
"approved": "commands the agent can run without prompting the operator"
|
|
41
|
+
}
|
|
42
|
+
},
|
|
43
|
+
{
|
|
44
|
+
"path": ".openclaw/.env",
|
|
45
|
+
"scope": "user",
|
|
46
|
+
"format": "dotenv",
|
|
47
|
+
"risk_surface": ["secret_leak", "env_override"]
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"path": ".openclaw/telegram.token",
|
|
51
|
+
"scope": "user",
|
|
52
|
+
"format": "text",
|
|
53
|
+
"risk_surface": ["secret_leak", "channel_token"]
|
|
54
|
+
}
|
|
55
|
+
],
|
|
56
|
+
"skill_paths": [
|
|
57
|
+
{
|
|
58
|
+
"path": ".openclaw/extensions/*/package.json",
|
|
59
|
+
"scope": "user",
|
|
60
|
+
"type": "plugin_manifest",
|
|
61
|
+
"risk_surface": ["plugin_install", "supply_chain", "command_exec", "remote_resource"]
|
|
62
|
+
},
|
|
63
|
+
{
|
|
64
|
+
"path": ".openclaw/agents/*/agent",
|
|
65
|
+
"scope": "user",
|
|
66
|
+
"type": "agent",
|
|
67
|
+
"risk_surface": ["agent_config", "tool_access", "channel_bindings", "prompt_injection"]
|
|
68
|
+
},
|
|
69
|
+
{
|
|
70
|
+
"path": ".openclaw/workspace/IDENTITY.md",
|
|
71
|
+
"scope": "user",
|
|
72
|
+
"type": "identity",
|
|
73
|
+
"risk_surface": ["prompt_injection", "persona_override"]
|
|
74
|
+
}
|
|
75
|
+
],
|
|
76
|
+
"extension_mechanisms": [
|
|
77
|
+
{
|
|
78
|
+
"type": "npm_plugin",
|
|
79
|
+
"install_pattern": ".openclaw/extensions/*/package.json",
|
|
80
|
+
"risk": "Plugins install via `npm install --omit=dev` with arbitrary package content; lifecycle scripts (postinstall, etc.) execute during install. Plugin code runs in-process with agent privileges.",
|
|
81
|
+
"fetchable": false
|
|
82
|
+
},
|
|
83
|
+
{
|
|
84
|
+
"type": "messaging_channel",
|
|
85
|
+
"install_pattern": ".openclaw/credentials/*",
|
|
86
|
+
"risk": "Inbound messages from external channels (WhatsApp, Telegram, Signal, Slack, iMessage, Discord, LINE, Matrix, Teams, Zalo, voice) feed untrusted text directly into LLM tool-use. Classic prompt-injection surface — every connected channel is an attacker-controllable input to the agent.",
|
|
87
|
+
"fetchable": false
|
|
88
|
+
},
|
|
89
|
+
{
|
|
90
|
+
"type": "hook",
|
|
91
|
+
"install_pattern": ".openclaw/hooks.json5",
|
|
92
|
+
"risk": "hooks.json5 declares shell commands to run before/after agent tool calls. An attacker with write access to this file can silently intercept or tamper with every agent action.",
|
|
93
|
+
"fetchable": false
|
|
94
|
+
}
|
|
95
|
+
]
|
|
96
|
+
}
|