registry / @dashclaw/cli / 0.6.1

@dashclaw/cli@0.6.1

DashClaw terminal client — approve agent actions and diagnose your instance

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 216 KB of source, external domains: api.github.com, codeload.github.com, github.com, hosted.dashclaw.io, registry.npmjs.org, your-dashclaw.vercel.app, your.vercel.app

Source & flagged code

3 flagged

bin/dashclaw.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { DashClaw } from 'dashclaw';

8import {

9 bold, dim, inverse, colorByRisk, clearScreen,

10 moveCursor, hideCursor, showCursor,

11 green, red,

12} from '../lib/render.js';

13import { runDoctor as runDoctorCommand } from '../lib/doctor.js';

14import { resolveConfig, clearConfigFile, configPath, ask, askSecret } from '../lib/config.js';

15import { runIngest, defaultClaudeProjectsDir } from '../lib/code/ingest.js';

16import { runMemo } from '../lib/code/memo.js';

17import { runApply } from '../lib/code/apply.js';

18import {

19 runCodexIngest,

20 defaultCodexSessionsDir,

21 defaultCodexOutDir,

22} from '../lib/code/ingest-codex.js';

Lines 276-316javascript

276 let parsed;

277 try {

278 parsed = new URL(url);

279 } catch {

280 return false;

281 }

282 const protocolOk = parsed.protocol === 'http:' ||

lib/up/run.jsView file

Lines 1-22javascript

1// cli/lib/up/run.js

2//

3// Build, start, health-wait, and open-browser primitives for `npx dashclaw up`.

5import { spawn, spawnSync } from 'node:child_process';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

7const shell = process.platform === 'win32';

Source & flagged code

3 flagged · loading source

bin/dashclaw.jsView file

2L3: import { execFileSync } from 'child_process'; L4: import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

296} else if (platform === 'win32') { L297: // Use PowerShell Start-Process instead of relying on cmd.exe parsing L298: execFileSync('powershell', ['-NoProfile', '-Command', 'Start-Process', url]);

High

Shell

Package source references shell execution.

bin/dashclaw.jsView on unpkg · L296

lib/up/run.jsView file

2// L3: // Build, start, health-wait, and open-browser primitives for `npx dashclaw up`. L4: L5: import { spawn, spawnSync } from 'node:child_process'; L6:

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

Findings

3 High3 Medium4 Low

HighChild Processbin/dashclaw.js

HighShellbin/dashclaw.js

HighRuntime Package Installlib/up/run.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/dashclaw.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { execFileSync } from 'child_process';

4import { readFileSync } from 'node:fs';

High

Child Process

Package source references child process execution.

bin/dashclaw.jsView on unpkg · L2

5import { dirname, resolve } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { DashClaw } from 'dashclaw';

8import {

9 bold, dim, inverse, colorByRisk, clearScreen,

10 moveCursor, hideCursor, showCursor,

11 green, red,

12} from '../lib/render.js';

13import { runDoctor as runDoctorCommand } from '../lib/doctor.js';

14import { resolveConfig, clearConfigFile, configPath, ask, askSecret } from '../lib/config.js';

15import { runIngest, defaultClaudeProjectsDir } from '../lib/code/ingest.js';

16import { runMemo } from '../lib/code/memo.js';

17import { runApply } from '../lib/code/apply.js';

18import {

19 runCodexIngest,

20 defaultCodexSessionsDir,

21 defaultCodexOutDir,

22} from '../lib/code/ingest-codex.js';

Lines 276-316javascript

276 let parsed;

277 try {

278 parsed = new URL(url);

279 } catch {

280 return false;

281 }

282 const protocolOk = parsed.protocol === 'http:' ||

lib/up/run.jsView file

Lines 1-22javascript

1// cli/lib/up/run.js

2//

3// Build, start, health-wait, and open-browser primitives for `npx dashclaw up`.

5import { spawn, spawnSync } from 'node:child_process';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/up/run.jsView on unpkg · L2

7const shell = process.platform === 'win32';