registry / @dashclaw/cli / 0.7.1

@dashclaw/cli@0.7.1

DashClaw terminal client — approve agent actions and diagnose your instance

Static Scan Results

scanned 36m ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 226 KB of source, external domains: api.github.com, codeload.github.com, github.com, hosted.dashclaw.io, registry.npmjs.org, your-dashclaw.vercel.app, your.vercel.app

Source & flagged code

4 flagged

bin/dashclaw.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { DashClaw } from 'dashclaw';

8import {

9 bold, dim, inverse, colorByRisk, clearScreen,

10 moveCursor, hideCursor, showCursor,

11 green, red,

12} from '../lib/render.js';

13import { runDoctor as runDoctorCommand } from '../lib/doctor.js';

14import { resolveConfig, clearConfigFile, configPath, ask, askSecret } from '../lib/config.js';

15import { runIngest, defaultClaudeProjectsDir } from '../lib/code/ingest.js';

16import { runMemo } from '../lib/code/memo.js';

17import { runApply } from '../lib/code/apply.js';

18import {

19 runCodexIngest,

20 defaultCodexSessionsDir,

21 defaultCodexOutDir,

22} from '../lib/code/ingest-codex.js';

Lines 278-318javascript

278 let parsed;

279 try {

280 parsed = new URL(url);

281 } catch {

282 return false;

283 }

284 const protocolOk = parsed.protocol === 'http:' ||

Lines 556-596javascript

556async function cmdInstall() {

557 const target = args[1];

558 switch (target) {

559 case 'codex':

560 return cmdInstallCodex();

561 case 'claude':

562

lib/up/run.jsView file

Lines 1-22javascript

1// cli/lib/up/run.js

2//

3// Build, start, health-wait, and open-browser primitives for `npx dashclaw up`.

5import { spawn, spawnSync } from 'node:child_process';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

7const shell = process.platform === 'win32';

Source & flagged code

4 flagged · loading source

bin/dashclaw.jsView file

2L3: import { execFileSync } from 'child_process'; L4: import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

298} else if (platform === 'win32') { L299: // Use PowerShell Start-Process instead of relying on cmd.exe parsing L300: execFileSync('powershell', ['-NoProfile', '-Command', 'Start-Process', url]);

High

Shell

Package source references shell execution.

bin/dashclaw.jsView on unpkg · L298

576*/ L577: async function cmdImport() { L578: const file = args[1];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dashclaw.jsView on unpkg · L576

lib/up/run.jsView file

2// L3: // Build, start, health-wait, and open-browser primitives for `npx dashclaw up`. L4: L5: import { spawn, spawnSync } from 'node:child_process'; L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

Findings

3 High4 Medium4 Low

HighChild Processbin/dashclaw.js

HighShellbin/dashclaw.js

HighRuntime Package Installlib/up/run.js

MediumDynamic Requirebin/dashclaw.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/dashclaw.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { DashClaw } from 'dashclaw';

8import {

9 bold, dim, inverse, colorByRisk, clearScreen,

10 moveCursor, hideCursor, showCursor,

11 green, red,

12} from '../lib/render.js';

13import { runDoctor as runDoctorCommand } from '../lib/doctor.js';

14import { resolveConfig, clearConfigFile, configPath, ask, askSecret } from '../lib/config.js';

15import { runIngest, defaultClaudeProjectsDir } from '../lib/code/ingest.js';

16import { runMemo } from '../lib/code/memo.js';

17import { runApply } from '../lib/code/apply.js';

18import {

19 runCodexIngest,

20 defaultCodexSessionsDir,

21 defaultCodexOutDir,

22} from '../lib/code/ingest-codex.js';

Lines 278-318javascript

278 let parsed;

279 try {

280 parsed = new URL(url);

281 } catch {

282 return false;

283 }

284 const protocolOk = parsed.protocol === 'http:' ||

Lines 556-596javascript

556async function cmdInstall() {

557 const target = args[1];

558 switch (target) {

559 case 'codex':

560 return cmdInstallCodex();

561 case 'claude':

562

lib/up/run.jsView file

Lines 1-22javascript

1// cli/lib/up/run.js

2//

3// Build, start, health-wait, and open-browser primitives for `npx dashclaw up`.

5import { spawn, spawnSync } from 'node:child_process';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

7const shell = process.platform === 'win32';