Scan Report
5 /100
openclaw-healthcheck
Lightweight operational and security review for an OpenClaw deployment — checks gateway reachability, exposed ports, config patterns, browser session/relay surface, log errors, and runtime hygiene.
A legitimate OpenClaw operational health-check tool with no malicious behavior — all filesystem and shell access is directly declared and purpose-appropriate for the stated audit functionality.
Safe to install
No action needed. The skill is safe to run as described.
Findings 1 items
| Severity | Finding | Location |
|---|---|---|
| Low | Missing allowed-tools declaration Doc Mismatch | SKILL.md:1 |
| Resource | Declared | Inferred | Status | Evidence |
|---|---|---|---|---|
| Shell | WRITE | WRITE | ✓ Aligned | execSync('openclaw status'), execSync('lsof ...'), execSync('tail ...') — all de… |
| Filesystem | READ | READ | ✓ Aligned | fs.readFileSync(configPath) and log tail — explicitly reading runtime state for … |
| Environment | NONE | READ | ✓ Aligned | os.homedir() is called to resolve ~/.openclaw; environment is passed through to … |
File Tree
6 files · 12.4 KB · 426 lines Markdown 3f · 270L
JavaScript 2f · 122L
JSON 1f · 34L
├─
▾
references
│ └─
checklist.md
Markdown
├─
▾
scripts
│ └─
healthcheck.mjs
JavaScript
├─
▾
tests
│ └─
test.mjs
JavaScript
├─
package.json
JSON
├─
README.md
Markdown
└─
SKILL.md
Markdown
Dependencies 1 items
| Package | Version | Source | Known Vulns | Notes |
|---|---|---|---|---|
none (pure Node.js stdlib) | N/A | stdlib only | No | healthcheck.mjs imports only child_process, fs, and os from the Node.js standard library |
Security Positives
✓ No credential harvesting or environment variable enumeration for sensitive keys
✓ No network requests to remote endpoints — all checks are local
✓ No obfuscation (no base64, eval, or dynamic code construction)
✓ No download or remote script execution (no curl|bash, wget|sh, pip install from untrusted sources)
✓ No access to sensitive paths such as ~/.ssh, ~/.aws, or .env files
✓ No data exfiltration — evidence objects stay in-process and are output as JSON
✓ No persistence mechanisms (no cron, systemd units, or startup hooks injected)
✓ The test file properly isolates its execution by creating a temporary HOME and PATH
✓ Code behavior is fully consistent with the SKILL.md documentation