中文 EN

Scan Report

Scan New Files

This report was generated in Chinese. Some content may be in Chinese.
✓ Trusted — Risk Score 0/100
Last scan:3 hr ago Rescan
0 /100
clawdoctor
Self-healing monitor for OpenClaw gateways, crons, and agent sessions
ClawDoctor 是一个合法的 OpenClaw 监控系统，所有 shell 执行、网络请求和文件系统操作均与声明功能一致，无阴影行为、无凭证收割、无数据外泄。
Skill Nameclawdoctor
Duration57.2s
Enginepi
ClawHub Clawdoctor v0.4.13 by relayplane
📥 170
ClawHub Verdict Suspicious dangerous_exec
✓
Safe to install
无需阻断。可直接部署使用。
ResourceDeclaredInferredStatusEvidence
Filesystem WRITE WRITE ✓ Aligned SKILL.md:config stored at ~/.clawdoctor; store.ts:SQLite events.db
Shell WRITE WRITE ✓ Aligned src/healers/process.ts:systemctl restart openclaw-gateway; src/utils.ts:runShell…
Network READ READ ✓ Aligned src/alerters/telegram.ts:HTTPS POST to api.telegram.org; src/config.ts:HTTPS POS…
Environment NONE NONE — 仅读取CLAWDOCTOR_KEY环境变量用于license验证，无敏感凭证遍历
10 findings
🔗
Medium External URL 外部 URL
https://clawdoctor.dev
CLAWDOCTOR-FACTSHEET.md:19
🔗
Medium External URL 外部 URL
https://www.npmjs.com/package/clawdoctor
CLAWDOCTOR-FACTSHEET.md:20
🔗
Medium External URL 外部 URL
https://buy.stripe.com/7sY14g2fsex33F08U51ck01
CLAWDOCTOR-FACTSHEET.md:23
🔗
Medium External URL 外部 URL
https://buy.stripe.com/eVq28k2fsdsZ7Vg6LX1ck02
CLAWDOCTOR-FACTSHEET.md:24
🔗
Medium External URL 外部 URL
https://clawdoctor.dev/docs
CLAWDOCTOR-FACTSHEET.md:25
🔗
Medium External URL 外部 URL
https://clawdoctor.dev/welcome?session_id=...
CLAWDOCTOR-FACTSHEET.md:26
🔗
Medium External URL 外部 URL
https://www.patreon.com/feross
package-lock.json:58
🔗
Medium External URL 外部 URL
https://feross.org/support
package-lock.json:62
🔗
Medium External URL 外部 URL
https://api.telegram.org
src/alerters/telegram.ts:10
🔗
Medium External URL 外部 URL
https://clawdoctor.dev/#pricing
src/daemon.ts:133

File Tree

33 files · 194.5 KB · 5618 lines
TypeScript 26f · 4150L Markdown 4f · 873L JSON 3f · 595L
├─ ▾ 📁 src
│ ├─ ▾ 📁 alerters
│ │ └─ 📜 telegram.ts TypeScript 329L · 10.4 KB
│ ├─ ▾ 📁 healers
│ │ ├─ 📜 auth.ts TypeScript 56L · 1.9 KB
│ │ ├─ 📜 base.ts TypeScript 76L · 1.9 KB
│ │ ├─ 📜 budget.ts TypeScript 82L · 2.9 KB
│ │ ├─ 📜 cron.ts TypeScript 169L · 6.6 KB
│ │ ├─ 📜 process.ts TypeScript 92L · 3.6 KB
│ │ └─ 📜 session.ts TypeScript 119L · 4.6 KB
│ ├─ ▾ 📁 test
│ │ ├─ 📜 config.test.ts TypeScript 58L · 2.3 KB
│ │ ├─ 📜 healers.test.ts TypeScript 258L · 9.9 KB
│ │ ├─ 📜 store.test.ts TypeScript 97L · 3.5 KB
│ │ ├─ 📜 telegram.test.ts TypeScript 116L · 5.0 KB
│ │ └─ 📜 watchers.test.ts TypeScript 219L · 7.8 KB
│ ├─ ▾ 📁 watchers
│ │ ├─ 📜 auth.ts TypeScript 197L · 6.0 KB
│ │ ├─ 📜 base.ts TypeScript 55L · 1.6 KB
│ │ ├─ 📜 budget.ts TypeScript 128L · 3.9 KB
│ │ ├─ 📜 cost.ts TypeScript 176L · 5.5 KB
│ │ ├─ 📜 cron.ts TypeScript 137L · 4.1 KB
│ │ ├─ 📜 gateway.ts TypeScript 37L · 1.4 KB
│ │ └─ 📜 session.ts TypeScript 160L · 5.8 KB
│ ├─ 📜 audit.ts TypeScript 38L · 1.1 KB
│ ├─ 📜 config.ts TypeScript 276L · 8.1 KB
│ ├─ 📜 daemon.ts TypeScript 433L · 15.8 KB
│ ├─ 📜 index.ts TypeScript 547L · 19.6 KB
│ ├─ 📜 snapshots.ts TypeScript 101L · 2.9 KB
│ ├─ 📜 store.ts TypeScript 141L · 4.1 KB
│ └─ 📜 utils.ts TypeScript 53L · 1.7 KB
├─ 📝 CLAWDOCTOR-FACTSHEET.md Markdown 365L · 17.2 KB
├─ 📋 package-lock.json JSON 527L · 18.3 KB
├─ 📋 package.json JSON 49L · 1.1 KB
├─ 📝 README.md Markdown 165L · 4.8 KB
├─ 📝 SKILL.md Markdown 108L · 3.3 KB
├─ 📝 TASK.md Markdown 235L · 7.5 KB
└─ 📋 tsconfig.json JSON 19L · 445 B

Dependencies 2 items

PackageVersionSourceKnown VulnsNotes
better-sqlite3 ^9.4.3 npm No 版本锁定，无已知漏洞
commander ^12.1.0 npm No 版本锁定，无已知漏洞

Security Positives

✓ 代码结构清晰，TypeScript类型安全，无混淆代码
✓ Rollback 命令白名单机制（snapshots.ts:ALLOWED_ROLLBACK_PREFIXES）防止任意命令执行
✓ Dry-run 模式支持，所有 healers 均支持只读测试
✓ Plan 分级强制（heal plan 才有 auto-fix），防止非授权操作
✓ SQLite 数据库本地存储，无外部数据外传
✓ Telegram bot token 需用户主动配置，无硬编码密钥
✓ Alert 去重（dedup）和速率限制机制，防止告警滥用
✓ License 验证走 HTTPS，有 8 秒超时保护
✓ Snapshot + Audit trail 完整操作追溯