registry / palz-connector / 1.7.3-beta.1

palz-connector@1.7.3-beta.1

Palz IM 接入 OpenClaw — 模块化架构，基于 OpenClaw Runtime 消息管道

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 26 file(s), 174 KB of source, external domains: claw.csaiagent.com, cstv-data.oss-cn-beijing.aliyuncs.com, oss.csaiagent.com, tracing-analysis-dc-bj.aliyuncs.com

Source & flagged code

1 flagged

src/media.jsView file

Lines 1-33javascript

1/**

2 * Palz Connector 媒体处理

3 *

4 * 将 IM 消息中的图片/文件上传到 OSS，返回公网 URL，

5 * 供 OpenClaw Runtime 作为媒体附件处理。

6 * 支持图片、PDF、DOCX、MD 等各类文件。

7 */

8import fs from "fs";

9import path from "path";

10import os from "os";

11import crypto from "crypto";

12import { uploadFileToOss, uploadBufferToOss } from "./oss.js";

13/** OpenClaw 允许访问的媒体目录 */

14const MEDIA_DIR = path.join(os.homedir(), ".openclaw", "media");

15const STATE_DIR = path.join(os.homedir(), ".openclaw");

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/media.jsView on unpkg · L13

16/**

17 * 根据 agentId 构造媒体文件搜索根路径列表，

18 * 与 OpenClaw 的 getAgentScopedMediaLocalRoots 逻辑对齐。

19 */

20export function resolveMediaLocalRoots(agentId, accountId) {

21 const roots = [MEDIA_DIR, path.join(STATE_DIR, "workspace"), path.join(STATE_DIR, "sandboxes")];

22 // user 目录下的 agent workspace: ~/.openclaw/{userId}/workspace-{agentId}

23 if (accountId?.startsWith("user-") && agentId?.trim()) {

24 roots.push(path.join(STATE_DIR, accountId, `workspace-${agentId}`));

25 }

26 if (agentId?.trim()) {

27 roots.push(path.join(STATE_DIR, `workspace-${agentId}`));

28 }

29 return [...new Set(roots)];

30}

31/**

32 * 将原始文件名清洁化：

33 * - 去掉路径分隔符与控制字符

Source & flagged code

1 flagged · loading source

src/media.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code