github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-18 11:47:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): harden plugin/hook npm installs

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-14 14:07:07 +01:00
parent d69b32a073
commit 6f7d31c426
10 changed files with 391 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/automation/hooks.md
View File

@@ -103,6 +103,8 @@ Hook packs are standard npm packages that export one or more hooks via `openclaw
openclaw hooks install <path-or-spec>
```
Npm specs are registry-only (package name + optional version/tag). Git/URL/file specs are rejected.
Example `package.json`:
```json
@@ -118,6 +120,10 @@ Example `package.json`:
Each entry points to a hook directory containing `HOOK.md` and `handler.ts` (or `index.ts`).
Hook packs can ship dependencies; they will be installed under `~/.openclaw/hooks/<id>`.
Security note: `openclaw hooks install` installs dependencies with `npm install --ignore-scripts`
(no lifecycle scripts). Keep hook pack dependency trees "pure JS/TS" and avoid packages that rely
on `postinstall` builds.
## Hook Structure
### HOOK.md Format

3
docs/cli/hooks.md
View File

@@ -192,6 +192,9 @@ openclaw hooks install <path-or-spec>
Install a hook pack from a local folder/archive or npm.
Npm specs are **registry-only** (package name + optional version/tag). Git/URL/file
specs are rejected. Dependency installs run with `--ignore-scripts` for safety.
**What it does:**
- Copies the hook pack into `~/.openclaw/hooks/<id>`

3
docs/cli/plugins.md
View File

@@ -44,6 +44,9 @@ openclaw plugins install <path-or-spec>
Security note: treat plugin installs like running code. Prefer pinned versions.
Npm specs are **registry-only** (package name + optional version/tag). Git/URL/file
specs are rejected. Dependency installs run with `--ignore-scripts` for safety.
Supported archives: `.zip`, `.tgz`, `.tar.gz`, `.tar`.
Use `--link` to avoid copying a local directory (adds to `plugins.load.paths`):

9
docs/tools/plugin.md
View File

@@ -31,6 +31,9 @@ openclaw plugins list
openclaw plugins install @openclaw/voice-call
```
Npm specs are **registry-only** (package name + optional version/tag). Git/URL/file
specs are rejected.
3. Restart the Gateway, then configure under `plugins.entries.<id>.config`.
See [Voice Call](/plugins/voice-call) for a concrete example plugin.
@@ -138,6 +141,10 @@ becomes `name/<fileBase>`.
If your plugin imports npm deps, install them in that directory so
`node_modules` is available (`npm install` / `pnpm install`).
Security note: `openclaw plugins install` installs plugin dependencies with
`npm install --ignore-scripts` (no lifecycle scripts). Keep plugin dependency
trees "pure JS/TS" and avoid packages that require `postinstall` builds.
### Channel catalog metadata
Channel plugins can advertise onboarding metadata via `openclaw.channel` and
@@ -424,7 +431,7 @@ Notes:
### Write a new messaging channel (step‑by‑step)
Use this when you want a **new chat surface** (a “messaging channel”), not a model provider.
Use this when you want a **new chat surface** (a "messaging channel"), not a model provider.
Model provider docs live under `/providers/*`.
1. Pick an id + config shape