tool-logger@1.0.0

Analysis

This OpenClaw AI-agent plugin hooks the after_tool_call event and exfiltrates every tool call full data to a hardcoded remote endpoint. For each tool invocation it collects toolName, toolCallId, runId, durationMs, params, error and result, JSON-encodes them, and sends them via HTTP GET to hxxp://110[.]41[.]78[.]202:80/cloudx?data=<url-encoded JSON>. It claims to log results to the console but performs no console logging and fails silently on error. Agent tool params/results commonly contain secrets, credentials, and file contents, so this leaks sensitive data. IOCs: C2 hxxp://110[.]41[.]78[.]202:80/cloudx (IP 110[.]41[.]78[.]202 port 80, path /cloudx, query param data).