Name: Dpetclaw 龙虾守护宠物 Security Report — Low Risk | ClawSafe
Item: Dpetclaw 龙虾守护宠物
Rating: 80
Author: ClawSafe

This report was generated in Chinese. Some content may be in Chinese.

20 /100

Dpetclaw 龙虾守护宠物

桌面端 AI 语音助手桌宠，基于声纹识别 + OpenClaw Gateway，为用户提供贴身语音指令入口

Dpetclaw 龙虾守护宠物是一个合法的桌面 AI 语音助手，具有声纹认证、语音识别和 OpenClaw 集成功能。代码审查未发现恶意行为，但存在轻微配置瑕疵（硬编码路径、shell=True 使用）

Skill NameDpetclaw 龙虾守护宠物

Duration82.7s

Enginepi

ClawHub Dpetclaw 龙虾守护宠物 v1.0.0 by stonestorm2024

📥 14

ClawHub Verdict Suspicious dangerous_execllm_suspiciousvt_suspicious

✓

Safe to install

建议修复硬编码的 Windows 用户路径为动态获取，并将 subprocess.Popen 的 shell=True 改为列表参数形式以减少安全风险

Findings 4 items

Severity	Finding	Location
Medium	subprocess 使用 shell=True 执行本地脚本 Priv Escalation app.py:694 使用 subprocess.Popen(..., shell=True) 执行 launch_command，存在潜在的命令注入风险。虽然执行的是受信任的本地启动脚本，但 shell=True 应避免使用。 `subprocess.Popen(self.config.launch_command, cwd=self.base_dir, shell=True, startupinfo=startupinfo, creationflags=creationflags)` → 将 shell=True 改为列表参数形式：subprocess.Popen([self.config.launch_command], ...)	`lobster_pet/app.py:694`
Low	硬编码的 Windows 用户路径 Sensitive Access config.py 中包含硬编码的 Windows 用户路径（如 C:\Users\super\...），这是开发环境遗留配置，在不同用户环境下会失效。 `launch_command: str = r"C:\Users\super\Desktop\新建文件夹\科研智能体\start_openclaw_dashboard.cmd"` → 使用 Path.home() / 'Desktop' / ... 动态获取用户桌面路径	`lobster_pet/config.py:31`
Low	SKILL.md 缺少 allowed-tools 声明 Doc Mismatch SKILL.md 未声明 allowed-tools 权限，导致无法确认实际权限范围。 `缺少 allowed-tools 声明` → 在 SKILL.md 中添加 allowed-tools 字段，明确声明所需的工具权限	`SKILL.md:1`
Info	requirements.txt 无版本锁定 Supply Chain requirements.txt 中依赖无版本锁定（如 SpeechRecognition>=3.14），存在供应链风险。 `SpeechRecognition>=3.14 PyAudio>=0.2.14 soundfile>=0.12.1` → 锁定依赖版本以防止依赖混淆攻击	`requirements.txt:1`

Resource	Declared	Inferred	Status	Evidence
Filesystem	`NONE`	`READ`	✓ Aligned	代码仅读取配置文件和声纹模型
Network	`READ`	`READ`	✓ Aligned	仅与 SiliconFlow API 和本地 OpenClaw Gateway 通信
Shell	`NONE`	`WRITE`	✓ Aligned	app.py:694 subprocess.Popen 执行启动脚本
Environment	`NONE`	`READ`	✓ Aligned	仅读取 SILICONFLOW_API_KEY

77 findings

🔗

Medium External URL 外部 URL

https://cloud.siliconflow.cn

README.md:34

🔗

Medium External URL 外部 URL

https://alphacephei.com/vosk/models/vosk-model-small-cn-0.22.zip

README.md:103

🔗

Medium External URL 外部 URL

https://alphacephei.com/vosk/models

README.md:107

🔗

Medium External URL 外部 URL

http://127.0.0.1:19001/

lobster_pet/app.py:1254

🔗

Medium External URL 外部 URL

https://api.siliconflow.cn/v1/chat/completions

lobster_pet/chat_client.py:40

🔗

Medium External URL 外部 URL

https://api.siliconflow.cn/v1/audio/speech

lobster_pet/tts_client.py:44

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@electron/get/-/get-2.0.3.tgz

package-lock.json:16

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@sindresorhus/is/-/is-4.6.0.tgz

package-lock.json:38

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@szmarczak/http-timer/-/http-timer-4.0.6.tgz

package-lock.json:51

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/cacheable-request/-/cacheable-request-6.0.3.tgz

package-lock.json:64

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz

package-lock.json:77

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/keyv/-/keyv-3.1.4.tgz

package-lock.json:84

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/node/-/node-22.19.15.tgz

package-lock.json:94

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/responselike/-/responselike-1.0.3.tgz

package-lock.json:104

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/@types/yauzl/-/yauzl-2.10.3.tgz

package-lock.json:114

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/boolean/-/boolean-3.2.0.tgz

package-lock.json:125

🔗

Medium External URL 外部 URL

https://www.npmjs.com/support

package-lock.json:127

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/buffer-crc32/-/buffer-crc32-0.2.13.tgz

package-lock.json:134

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/cacheable-lookup/-/cacheable-lookup-5.0.4.tgz

package-lock.json:144

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/cacheable-request/-/cacheable-request-7.0.4.tgz

package-lock.json:154

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/clone-response/-/clone-response-1.0.3.tgz

package-lock.json:173

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/debug/-/debug-4.4.3.tgz

package-lock.json:186

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/decompress-response/-/decompress-response-6.0.0.tgz

package-lock.json:204

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/mimic-response/-/mimic-response-3.1.0.tgz

package-lock.json:220

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/defer-to-connect/-/defer-to-connect-2.0.1.tgz

package-lock.json:233

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/define-data-property/-/define-data-property-1.1.4.tgz

package-lock.json:243

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/define-properties/-/define-properties-1.2.1.tgz

package-lock.json:262

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/detect-node/-/detect-node-2.1.0.tgz

package-lock.json:281

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/electron/-/electron-35.7.5.tgz

package-lock.json:289

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/end-of-stream/-/end-of-stream-1.4.5.tgz

package-lock.json:308

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/env-paths/-/env-paths-2.2.1.tgz

package-lock.json:318

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/es-define-property/-/es-define-property-1.0.1.tgz

package-lock.json:328

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/es-errors/-/es-errors-1.3.0.tgz

package-lock.json:339

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/es6-error/-/es6-error-4.1.1.tgz

package-lock.json:350

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz

package-lock.json:358

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/extract-zip/-/extract-zip-2.0.1.tgz

package-lock.json:372

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/fd-slicer/-/fd-slicer-1.1.0.tgz

package-lock.json:393

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/fs-extra/-/fs-extra-8.1.0.tgz

package-lock.json:403

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/get-stream/-/get-stream-5.2.0.tgz

package-lock.json:418

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/global-agent/-/global-agent-3.0.0.tgz

package-lock.json:434

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/semver/-/semver-7.7.4.tgz

package-lock.json:453

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/globalthis/-/globalthis-1.0.4.tgz

package-lock.json:467

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/gopd/-/gopd-1.2.0.tgz

package-lock.json:485

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/got/-/got-11.8.6.tgz

package-lock.json:499

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/graceful-fs/-/graceful-fs-4.2.11.tgz

package-lock.json:525

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/has-property-descriptors/-/has-property-descriptors-1.0.2.tgz

package-lock.json:532

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz

package-lock.json:546

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/http2-wrapper/-/http2-wrapper-1.0.3.tgz

package-lock.json:553

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/json-buffer/-/json-buffer-3.0.1.tgz

package-lock.json:567

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/json-stringify-safe/-/json-stringify-safe-5.0.1.tgz

package-lock.json:574

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/jsonfile/-/jsonfile-4.0.0.tgz

package-lock.json:582

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/keyv/-/keyv-4.5.4.tgz

package-lock.json:592

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/lowercase-keys/-/lowercase-keys-2.0.0.tgz

package-lock.json:602

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/matcher/-/matcher-3.0.0.tgz

package-lock.json:612

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/mimic-response/-/mimic-response-1.0.1.tgz

package-lock.json:626

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/ms/-/ms-2.1.3.tgz

package-lock.json:636

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/normalize-url/-/normalize-url-6.1.0.tgz

package-lock.json:643

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/object-keys/-/object-keys-1.1.1.tgz

package-lock.json:656

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/once/-/once-1.4.0.tgz

package-lock.json:667

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/p-cancelable/-/p-cancelable-2.1.1.tgz

package-lock.json:677

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/pend/-/pend-1.2.0.tgz

package-lock.json:687

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/progress/-/progress-2.0.3.tgz

package-lock.json:694

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/pump/-/pump-3.0.4.tgz

package-lock.json:704

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/quick-lru/-/quick-lru-5.1.1.tgz

package-lock.json:715

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/resolve-alpn/-/resolve-alpn-1.2.1.tgz

package-lock.json:728

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/responselike/-/responselike-2.0.1.tgz

package-lock.json:735

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/roarr/-/roarr-2.15.4.tgz

package-lock.json:748

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/semver/-/semver-6.3.1.tgz

package-lock.json:767

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/semver-compare/-/semver-compare-1.0.0.tgz

package-lock.json:777

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/serialize-error/-/serialize-error-7.0.1.tgz

package-lock.json:785

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/sprintf-js/-/sprintf-js-1.1.3.tgz

package-lock.json:802

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/sumchecker/-/sumchecker-3.0.1.tgz

package-lock.json:810

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/type-fest/-/type-fest-0.13.1.tgz

package-lock.json:823

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/undici-types/-/undici-types-6.21.0.tgz

package-lock.json:837

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/universalify/-/universalify-0.1.2.tgz

package-lock.json:844

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/wrappy/-/wrappy-1.0.2.tgz

package-lock.json:854

🔗

Medium External URL 外部 URL

https://registry.npmmirror.com/yauzl/-/yauzl-2.10.0.tgz

package-lock.json:861

File Tree

29 files · 237.5 KB · 6756 lines

Python 18f · 4402L JSON 2f · 883L CSS 1f · 596L JavaScript 4f · 513L Markdown 2f · 295L HTML 1f · 64L Text 1f · 3L

├─ ▾ 📁 electron

│ ├─ ▾ 📁 renderer

│ │ ├─ 📄 index.html HTML 64L · 2.0 KB

│ │ ├─ 📜 renderer.js JavaScript 74L · 2.0 KB

│ │ └─ 📄 styles.css CSS 596L · 12.2 KB

│ ├─ 📜 main.js JavaScript 167L · 3.9 KB

│ └─ 📜 preload.js JavaScript 6L · 265 B

├─ ▾ 📁 lobster_pet

│ ├─ 🐍 __init__.py Python 1L · 35 B

│ ├─ 🐍 app.py Python 1570L · 67.1 KB

│ ├─ 🐍 chat_client.py Python 139L · 5.1 KB

│ ├─ 🐍 config.py Python 97L · 3.4 KB

│ ├─ 🐍 electron_bridge_main.py Python 18L · 412 B

│ ├─ 🐍 headless_window.py Python 81L · 2.4 KB

│ ├─ 🐍 openclaw_client.py Python 160L · 5.4 KB

│ ├─ 🐍 pet_window.py Python 567L · 22.3 KB

│ ├─ 🐍 speaker_verifier.py Python 286L · 10.9 KB

│ ├─ 🐍 states.py Python 37L · 1.3 KB

│ ├─ 🐍 tts_client.py Python 65L · 2.1 KB

│ └─ 🐍 voice_listener.py Python 1067L · 41.0 KB

├─ 🐍 main.py Python 5L · 91 B

├─ 📜 openclaw_bridge.mjs JavaScript 266L · 6.7 KB

├─ 📋 package-lock.json JSON 871L · 30.3 KB

├─ 📋 package.json JSON 12L · 210 B

├─ 📝 README.md Markdown 190L · 5.8 KB

├─ 🐍 register_owner_voice.py Python 63L · 2.3 KB

├─ 📄 requirements.txt Text 3L · 58 B

├─ 🐍 siliconflow_qwen_omni_chat.py Python 75L · 1.9 KB

├─ 📝 SKILL.md Markdown 105L · 3.3 KB

├─ 🐍 test_listen.py Python 43L · 1.2 KB

├─ 🐍 test_microphones.py Python 64L · 1.6 KB

└─ 🐍 verify_owner_voice.py Python 64L · 2.2 KB

Dependencies 4 items

Package	Version	Source	Known Vulns	Notes
`SpeechRecognition`	`>=3.14`	pip	No	无版本锁定
`PyAudio`	`>=0.2.14`	pip	No	无版本锁定
`soundfile`	`>=0.12.1`	pip	No	无版本锁定
`speechbrain`	`未指定`	代码导入	No	用于声纹识别模型

Security Positives

✓ 声纹验证机制合法且有效，非主人无法操控系统

✓ 访客模式设计合理，限制了对本地数据的访问

✓ 外部通信仅限 SiliconFlow API 和本地 OpenClaw Gateway，无可疑外泄

✓ 代码无混淆、无隐藏后门、无提示词注入

✓ base64 仅用于音频数据编码用于 ASR API，符合正常用途

Scan Report

Findings 4 items

File Tree

Dependencies 4 items

Security Positives