中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：21 小时前 重新扫描
20 /100
chatclaw
Connect your OpenClaw bot to the ChatClaw cloud dashboard for real-time remote chat, token tracking, and task management
ChatClaw is a legitimate message relay skill that connects local OpenClaw agents to a cloud dashboard via WebSocket tunnels. No malicious behavior detected; all declared capabilities match implementation.
技能名称chatclaw
分析耗时44.5s
引擎pi
✓
可以安装
Approve for use. Consider pinning dependency versions in requirements.txt to reduce supply chain risk.

安全发现 1 项

严重性 安全发现 位置
低危
Dependencies not version-pinned 供应链
requirements.txt specifies dependencies with minimum version constraints only (>=) without upper bounds or exact versions. This allows installing potentially incompatible or compromised future versions.
websockets>=12.0
cryptography>=41.0
aiohttp>=3.9
→ Pin exact versions or use acceptable range constraints (e.g., 'websockets>=12.0,<13.0') to reduce supply chain risk.
 requirements.txt:1
资源类型声明权限推断权限状态证据
文件系统 WRITE WRITE ✓ 一致 main.py:52-80 - reads/writes openclaw.json; gateway_client.py:45-68 - reads iden…
网络访问 READ READ ✓ 一致 relay_client.py:30 - connects to wss://api.sumeralabs.com; gateway_client.py:170…
命令执行 NONE NONE — No subprocess, os.system, or shell command execution found
环境变量 READ READ ✓ 一致 gateway_client.py:23-29 - reads OPENCLAW_DATA_DIR only; main.py:65-66 - reads CH…
技能调用 NONE NONE — No skill invocation or LLM prompt manipulation detected
剪贴板 NONE NONE — No clipboard access found
浏览器 NONE NONE — No browser automation found
数据库 NONE NONE — No database access found
4 项发现
🔗
中危 外部 URL 外部 URL
https://app.chatclaw.com
README.md:9
🔗
中危 外部 URL 外部 URL
https://opensource.org/licenses/MIT-0
README.md:89
🔗
中危 外部 URL 外部 URL
https://chatclaw.com
SKILL.md:6
🔗
中危 外部 URL 外部 URL
https://app.chatclaw.com/setup
SKILL.md:89

目录结构

6 文件 · 37.9 KB · 975 行
Python 3f · 707L Markdown 2f · 266L Text 1f · 2L
├─ 🐍 gateway_client.py Python 322L · 12.7 KB
├─ 🐍 main.py Python 300L · 11.5 KB
├─ 📝 README.md Markdown 89L · 2.6 KB
├─ 🐍 relay_client.py Python 85L · 3.2 KB
├─ 📄 requirements.txt Text 2L · 48 B
└─ 📝 SKILL.md Markdown 177L · 7.8 KB

依赖分析 3 项

包名版本来源已知漏洞备注
websockets >=12.0 pip 否 Version not pinned - allows any 12.x+ version
cryptography >=41.0 pip 否 Version not pinned - allows any 41.x+ version
aiohttp >=3.9 pip 否 Version not pinned - allows any 3.9+ version

安全亮点

✓ Comprehensive SKILL.md documentation with explicit transparency notes about cloud infrastructure operators
✓ All file access scoped to $OPENCLAW_DATA_DIR with declared purpose (identity files, config, sessions)
✓ No shell execution or subprocess usage - pure asyncio/websocket architecture
✓ No credential exfiltration - API key used only for authentication to declared cloud relay
✓ No obfuscation or anti-analysis techniques detected
✓ Clean code with proper error handling and atomic file writes
✓ Sensitive files (~/.ssh, ~/.aws, .env) never accessed
✓ Ed25519 cryptography for authentication - modern and secure
✓ Auto-revert mechanism for config patches on skill disable
✓ Exponential backoff reconnection with 60s cap