中文 EN

Scan Report

Scan New Files

⚠ Low Risk — Risk Score 20/100
Last scan:1 day ago Rescan
20 /100
agency-hq
A pixel art office visualization for AI agent teams. Shows real-time agent status, activity feeds, and personality-driven banter. Works with OpenClaw in live mode or standalone in demo mode.
A pixel-art visualization dashboard that reads OpenClaw session files and system stats; all core behavior is documented though a few minor filesystem paths accessed are not explicitly declared.
Skill Nameagency-hq
Duration48.3s
Enginepi
✓
Safe to install
No blocking action needed. Consider documenting the undeclared ~/.openclaw/cron/runs/ path access in SKILL.md for full transparency.

Findings 2 items

Severity Finding Location
Low
Undeclared cron/runs directory access Doc Mismatch
activity/route.ts reads files from ~/.openclaw/cron/runs/*.jsonl to display cron job activities. This is a filesystem:READ operation on a path not mentioned in SKILL.md.
const cronRunsDir = path.join(openclawHome, 'cron', 'runs');
→ Add 'cron/runs/*.jsonl' to the documented filesystem access scope in SKILL.md under 'How Live Mode Works'.
 src/app/api/agents/activity/route.ts:52
Low
Undeclared ps aux process listing Doc Mismatch
status/route.ts uses `ps aux | grep` to determine if an agent is running. SKILL.md lists uptime/free/df as the system commands used but does not mention ps.
const result = execSync(`ps aux | grep -i "agent.*${agentId}" | grep -v grep | head -1`, { encoding: 'utf-8', timeout: 3000 });
→ Update SKILL.md to list 'ps aux' as an additional system command used for agent process detection.
 src/app/api/agents/status/route.ts:62
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ ✓ Aligned SKILL.md declares scanning ~/.openclaw/agents/{id}/sessions/*.jsonl; activity/ro…
Shell READ READ ✓ Aligned stats/route.ts:9-36 uses execSync for uptime, /proc/loadavg, free -m, df — all l…
Environment NONE READ ✓ Aligned HOME and ARENA_MODE env vars are read; no sensitive key iteration
Network NONE NONE — No outbound network requests found; only internal localhost responses
Clipboard NONE NONE — Not accessed
Browser NONE NONE — UI component only, no browser automation
Database NONE NONE — SKILL.md explicitly states 'No database'
Skill Invoke NONE NONE — No skill self-invocation or subprocess spawning of other skills
3 findings
🔗
Medium External URL 外部 URL
https://vercel.com/button
README.md:123
🔗
Medium External URL 外部 URL
https://vercel.com/new/clone?repository-url=https%3A%2F%2Fgithub.com%2Fenjinstudio%2Fagency-hq
README.md:123
🔗
Medium External URL 外部 URL
https://enjinstudio.com
README.md:198

File Tree

25 files · 155.6 KB · 4415 lines
TypeScript 12f · 3877L Markdown 2f · 295L JavaScript 3f · 113L CSS 1f · 68L JSON 2f · 62L
├─ ▾ 📁 public
│ ├─ 📦 file.svg 391 B
│ ├─ 📦 globe.svg 1.0 KB
│ ├─ 📦 next.svg 1.3 KB
│ ├─ 📦 vercel.svg 128 B
│ └─ 📦 window.svg 385 B
├─ ▾ 📁 scripts
│ └─ 📜 generate-og-image.js JavaScript 88L · 2.3 KB
├─ ▾ 📁 src
│ ├─ ▾ 📁 app
│ │ ├─ ▾ 📁 api
│ │ │ └─ ▾ 📁 agents
│ │ │ ├─ ▾ 📁 activity
│ │ │ │ └─ 📜 route.ts TypeScript 162L · 6.4 KB
│ │ │ ├─ ▾ 📁 mode
│ │ │ │ └─ 📜 route.ts TypeScript 6L · 193 B
│ │ │ ├─ ▾ 📁 stats
│ │ │ │ └─ 📜 route.ts TypeScript 97L · 2.7 KB
│ │ │ └─ ▾ 📁 status
│ │ │ └─ 📜 route.ts TypeScript 158L · 4.8 KB
│ │ ├─ 📄 globals.css CSS 68L · 1.1 KB
│ │ ├─ 📜 layout.tsx TypeScript 33L · 983 B
│ │ └─ 📜 page.tsx TypeScript 270L · 10.8 KB
│ ├─ ▾ 📁 components
│ │ ├─ 📜 ActivityPanel.tsx TypeScript 422L · 17.9 KB
│ │ └─ 📜 PixelOffice.tsx TypeScript 2241L · 75.8 KB
│ └─ ▾ 📁 lib
│ ├─ 📜 agent-chat.ts TypeScript 279L · 8.3 KB
│ ├─ 📜 agents.ts TypeScript 77L · 3.3 KB
│ └─ 📜 demo-data.ts TypeScript 125L · 6.5 KB
├─ 📜 eslint.config.mjs JavaScript 18L · 465 B
├─ 📜 next.config.ts TypeScript 7L · 133 B
├─ 📋 package.json JSON 28L · 582 B
├─ 📜 postcss.config.mjs JavaScript 7L · 94 B
├─ 📝 README.md Markdown 198L · 6.6 KB
├─ 📝 SKILL.md Markdown 97L · 3.1 KB
└─ 📋 tsconfig.json JSON 34L · 670 B

Dependencies 4 items

PackageVersionSourceKnown VulnsNotes
next 16.1.6 npm No Pinned major version
pixi.js ^8.17.0 npm No Major version pinned
react 19.2.3 npm No Exact version
canvas ^3.2.1 npm (dev) No Used only in build script generate-og-image.js

Security Positives

✓ No credential harvesting — skill never reads SSH keys, AWS credentials, .env, or similar sensitive paths
✓ No data exfiltration — no outbound HTTP requests to external IPs
✓ No obfuscation — no base64, atob(), or encoded payload patterns
✓ No supply chain threats — all npm dependencies are standard with pinned major versions
✓ Shell commands are limited to read-only monitoring tools (uptime, free, df, ps, cat /proc/loadavg)
✓ Filesystem access is scoped to the user's own OpenClaw session data, not arbitrary system files
✓ Demo mode provides a zero-access fallback that works without touching any local resources
✓ SKILL.md correctly states 'No database. No external APIs.' — confirmed by code review
✓ Process listing via ps aux is used only to check local agent status, not for any credential or data gathering