registry / sealclaw / 2026.6.28

sealclaw@2026.6.28

⚠ Under review

Multi-channel AI gateway with extensible messaging integrations

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 32 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5,017 file(s), 48.4 MB of source, external domains: 127.0.0.1, 169.254.169.254, 192.168.1.100, a.co, accounts.feishu.cn, accounts.google.com, accounts.larksuite.com, accounts.openai.com, ai-gateway.vercel.sh, ai.azure.com, aiplatform.googleapis.com, aistudio.google.com, aka.ms, albumart.url, alimama.taobao.com, api-dashboard.search.brave.com, api-data.line.me, api.anthropic.com, api.arcee.ai, api.botframework.azure.cn, api.botframework.com, api.botframework.us, api.cerebras.ai, api.chutes.ai, api.cloudflare.com, api.copilot.example, api.deepgram.com, api.deepinfra.com, api.deepseek.com, api.elevenlabs.io, api.exa.ai, api.example.com, api.firecrawl.dev, api.fireworks.ai, api.github.com, api.gradium.ai, api.groq.com, api.individual.githubcopilot.com, api.inworld.ai, api.kilo.ai, api.kimi.com, api.line.me, api.minimax.io, api.minimaxi.com, api.mistral.ai, api.moonshot.ai, api.moonshot.cn, api.openai.com, api.perplexity.ai, api.plivo.com

Oversized source lightweight scan

dist/opus-ml-BpvY4m0z.js3.91 MB file, sampled 256 KB

HighEntropyStrings

dist/session.runtime-Cb-Z-Nqd.js3.80 MB file, sampled 256 KB

FilesystemChildProcessCryptoShellWebSocket

Source & flagged code

21 flagged

package.jsonView file

Lines 1550-1590json

1550 "mac:package": "bash scripts/package-mac-app.sh",

1551 "mac:restart": "bash scripts/restart-mac.sh",

1552 "moltbot:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1553 "openclaw": "node scripts/run-node.mjs",

1554 "openclaw:rpc": "node scripts/run-node.mjs agent --mode rpc --json",

1555 "perf:kova:summary": "node scripts/kova-ci-summary.mjs",

1556 "perf:source:summary": "node scripts/openclaw-performance-source-summary.mjs",

1557 "plugin-sdk:api:check": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --check",

1558 "plugin-sdk:api:gen": "node --max-old-space-size=8192 --import tsx scripts/generate-plugin-sdk-api-baseline.ts --write",

1559 "plugin-sdk:check-exports": "node scripts/sync-plugin-sdk-exports.mjs --check",

1560 "plugin-sdk:sync-exports": "node scripts/sync-plugin-sdk-exports.mjs",

1561 "plugin-sdk:usage": "node --import tsx scripts/analyze-plugin-sdk-usage.ts",

1562 "plugins:boundary-report": "node --import tsx scripts/plugin-boundary-report.ts",

1563 "plugins:boundary-report:ci": "node --import tsx scripts/plugin-boundary-report.ts --summary --fail-on-cross-owner --fail-on-unclassified-unused-reserved --fail-on-eligible-compat",

1564 "plugins:boundary-report:json": "node --import tsx scripts/plugin-boundary-report.ts --json",

1565 "plugins:boundary-report:summary": "node --import tsx scripts/plugin-boundary-report.ts --summary",

1566 "plugins:inventory:check": "node scripts/generate-plugin-inventory-doc.mjs --check",

1567 "plugins:inventory:gen": "node scripts/generate-plugin-inventory-doc.mjs --write",

1568 "plugins:sync": "node --import tsx scripts/sync-plugin-versions.ts",

1569 "plugins:sync:check": "node --import tsx scripts/sync-plugin-versions.ts --check",

1570 "postinstall": "node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L1570

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L1570

1571 "preinstall": "node scripts/preinstall-package-manager-warning.mjs",

1572 "prepush:ci": "bash scripts/prepush-ci.sh",

1573 "probe:anthropic:prompt": "node --import tsx scripts/anthropic-prompt-probe.ts",

1574 "prompt:snapshots:check": "node --import tsx scripts/generate-prompt-snapshots.ts --check",

1575 "prompt:snapshots:gen": "node --import tsx scripts/generate-prompt-snapshots.ts --write",

1576 "prompt:snapshots:sync-codex-model": "node --import tsx scripts/sync-codex-model-prompt-fixture.ts",

1577 "protocol:check": "pnpm protocol:gen && pnpm protocol:gen:swift && git diff --exit-code -- dist/protocol.schema.json apps/macos/Sources/OpenClawProtocol/GatewayModels.swift apps/shared/OpenClawKit/Sources/OpenClawProtocol/GatewayModels.swift",

1578 "protocol:gen": "node --import tsx scripts/protocol-gen.ts",

1579 "protocol:gen:swift": "node --import tsx scripts/protocol-gen-swift.ts",

1580 "proxy:coverage": "node scripts/run-node.mjs proxy coverage",

1581 "proxy:gateway": "node scripts/run-node.mjs proxy run -- node scripts/run-node.mjs gateway",

1582 "proxy:install-ca": "node --import tsx scripts/proxy-install-ca.mjs",

1583 "proxy:run": "node scripts/run-node.mjs proxy run",

1584 "proxy:start": "node scripts/run-node.mjs proxy start",

1585 "qa:e2e": "node --import tsx scripts/qa-e2e.ts",

1586 "qa:lab:build": "vite build --config extensions/qa-lab/web/vite.config.ts",

1587 "qa:lab:ui": "pnpm openclaw qa ui",

1588 "qa:lab:up": "node --import tsx scripts/qa-lab-up.ts",

1589 "qa:lab:up:fast": "node --import tsx scripts/qa-lab-up.ts --use-prebuilt-image --bind-ui-dist --skip-ui-build",

1590 "qa:lab:watch": "vite build --watch --config extensions/qa-lab/web/vite.config.ts",

dist/src-Bs9zDFWX.jsView file

Lines 1380-1420javascript

1380//#region node_modules/jwks-rsa/node_modules/jose/dist/node/cjs/key/import.js

1381var require_import = /* @__PURE__ */ __commonJSMin(((exports) => {

1382 Object.defineProperty(exports, "__esModule", { value: true });

1383

openclaw.mjsView file

Lines 265-305javascript

265 if (!isModuleNotFoundError(err)) {

266 return false;

267 }

268

269 const expectedUrl = new URL(specifier,

dist/control-ui/assets/index-DZ9XVD38.jsView file

5411contains invisible/control Unicode U+200C (zero width non-joiner) `}var mJ=te(T(((e,t)=>{(function(n,r){typeof e==`object`&&t!==void 0?t.exports=r():typeof define==`function`&&define.amd?define(r):n.JSON5=r()})(e,(function(){function e(e,t){return t={exports:{}},e(t,t.exports),t.exports}var t=e(function

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DZ9XVD38.jsView on unpkg · L5411

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/session.runtime-Cb-Z-Nqd.jsView file

•path = dist/session.runtime-Cb-Z-Nqd.js kind = oversized_source_file sizeBytes = 3979755 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/session.runtime-Cb-Z-Nqd.jsView on unpkg

dist/slash-state-BIkDmzh6.jsView file

Lines 1445-1485javascript

1445 });

1446}

1447function sendJsonResponse(res, status, body) {

1448 res.statusCode = status;

1449 res.setHeader("Content-Type", "application/json; charset=utf-8");

dist/proxy-cli.runtime-wueLjgDx.jsView file

Lines 744-784javascript

744 env: childEnv,

745 cwd: process$1.cwd()

746 });

747 child.once("error", reject);

748 child.once("exit", (code, signal

dist/dist-q5g9hUi6.jsView file

4879patternName = generic_password severity = medium line = 4879 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-q5g9hUi6.js

dist/dist-q5g9hUi6.jsView on unpkg · L4879

12428patternName = generic_password severity = medium line = 12428 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-q5g9hUi6.js

dist/dist-q5g9hUi6.jsView on unpkg · L12428

docs/install/macos-vm.mdView file

217patternName = generic_password severity = medium line = 217 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L217

docs/help/faq.mdView file

1439patternName = generic_password severity = medium line = 1439 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L1439

docs/gateway/tailscale.mdView file

99patternName = generic_password severity = medium line = 99 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L99

docs/gateway/configuration-reference.mdView file

365patternName = generic_password severity = medium line = 365 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L365

395patternName = generic_password severity = medium line = 395 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L395

docs/gateway/config-channels.mdView file

725patternName = generic_password severity = medium line = 725 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/config-channels.md

docs/gateway/config-channels.mdView on unpkg · L725

docs/channels/bluebubbles.mdView file

47patternName = generic_password severity = medium line = 47 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L47

docs/channels/matrix.mdView file

72patternName = generic_password severity = medium line = 72 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L72

docs/channels/irc.mdView file

200patternName = generic_password severity = medium line = 200 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L200

Source & flagged code

21 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall-bundled-plugins.mjs && node scripts/postinstall-patch-pi-ai.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/src-Bs9zDFWX.jsView file

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/src-Bs9zDFWX.jsView on unpkg · L1400

1400patternName = private_key_rsa severity = critical line = 1400 matchedText = if (type...g");

Critical

Secret Pattern

RSA private key in dist/src-Bs9zDFWX.js

dist/src-Bs9zDFWX.jsView on unpkg · L1400

openclaw.mjsView file

285try { L286: const mod = await import(specifier); L287: if (typeof mod.installProcessWarningFilter === "function") {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

openclaw.mjsView on unpkg · L285

dist/control-ui/assets/index-DZ9XVD38.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/control-ui/assets/index-DZ9XVD38.jsView on unpkg · L5411

skills/model-usage/scripts/test_model_usage.pyView file

•path = skills/model-usage/scripts/test_model_usage.py kind = build_helper sizeBytes = 1310 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/model-usage/scripts/test_model_usage.pyView on unpkg

dist/session.runtime-Cb-Z-Nqd.jsView file

•path = dist/session.runtime-Cb-Z-Nqd.js kind = oversized_source_file sizeBytes = 3979755 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/session.runtime-Cb-Z-Nqd.jsView on unpkg

dist/slash-state-BIkDmzh6.jsView file

1465patternName = generic_password severity = medium line = 1465 matchedText = url.pass...ed";

Medium

Secret Pattern

Hardcoded password in dist/slash-state-BIkDmzh6.js

dist/slash-state-BIkDmzh6.jsView on unpkg · L1465

dist/proxy-cli.runtime-wueLjgDx.jsView file

764patternName = generic_password severity = medium line = 764 matchedText = url.pass...ed";

Medium

Secret Pattern

Hardcoded password in dist/proxy-cli.runtime-wueLjgDx.js

dist/proxy-cli.runtime-wueLjgDx.jsView on unpkg · L764

dist/dist-q5g9hUi6.jsView file

4879patternName = generic_password severity = medium line = 4879 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-q5g9hUi6.js

dist/dist-q5g9hUi6.jsView on unpkg · L4879

12428patternName = generic_password severity = medium line = 12428 matchedText = passwo...

Medium

Secret Pattern

Hardcoded password in dist/dist-q5g9hUi6.js

dist/dist-q5g9hUi6.jsView on unpkg · L12428

docs/install/macos-vm.mdView file

217patternName = generic_password severity = medium line = 217 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/install/macos-vm.md

docs/install/macos-vm.mdView on unpkg · L217

docs/help/faq.mdView file

1439patternName = generic_password severity = medium line = 1439 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/help/faq.md

docs/help/faq.mdView on unpkg · L1439

docs/gateway/tailscale.mdView file

99patternName = generic_password severity = medium line = 99 matchedText = auth: { ..." },

Medium

Secret Pattern

Hardcoded password in docs/gateway/tailscale.md

docs/gateway/tailscale.mdView on unpkg · L99

docs/gateway/configuration-reference.mdView file

365patternName = generic_password severity = medium line = 365 matchedText = // passw...WORD

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L365

395patternName = generic_password severity = medium line = 395 matchedText = // passw...rd",

Medium

Secret Pattern

Hardcoded password in docs/gateway/configuration-reference.md

docs/gateway/configuration-reference.mdView on unpkg · L395

docs/gateway/config-channels.mdView file

725patternName = generic_password severity = medium line = 725 matchedText = password...D}",

Medium

Secret Pattern

Hardcoded password in docs/gateway/config-channels.md

docs/gateway/config-channels.mdView on unpkg · L725

docs/channels/bluebubbles.mdView file

47patternName = generic_password severity = medium line = 47 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/bluebubbles.md

docs/channels/bluebubbles.mdView on unpkg · L47

docs/channels/matrix.mdView file

72patternName = generic_password severity = medium line = 72 matchedText = password...cret

Medium

Secret Pattern

Hardcoded password in docs/channels/matrix.md

docs/channels/matrix.mdView on unpkg · L72

docs/channels/irc.mdView file

200patternName = generic_password severity = medium line = 200 matchedText = password...rd",

Medium

Secret Pattern

Hardcoded password in docs/channels/irc.md

docs/channels/irc.mdView on unpkg · L200

Findings

3 Critical2 High20 Medium7 Low

CriticalCritical Secretdist/src-Bs9zDFWX.js

CriticalTrojan Source Unicodedist/control-ui/assets/index-DZ9XVD38.js

CriticalSecret Patterndist/src-Bs9zDFWX.js

HighInstall Time Lifecycle Scriptspackage.json

HighOversized Source Filedist/session.runtime-Cb-Z-Nqd.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireopenclaw.mjs

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumShips Build Helperskills/model-usage/scripts/test_model_usage.py

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/slash-state-BIkDmzh6.js

MediumSecret Patterndist/proxy-cli.runtime-wueLjgDx.js

MediumSecret Patterndist/dist-q5g9hUi6.js

MediumSecret Patterndocs/install/macos-vm.md

MediumSecret Patterndocs/help/faq.md

MediumSecret Patterndocs/gateway/tailscale.md

MediumSecret Patterndocs/gateway/configuration-reference.md

MediumSecret Patterndocs/gateway/config-channels.md

MediumSecret Patterndocs/channels/bluebubbles.md

MediumSecret Patterndocs/channels/matrix.md

MediumSecret Patterndocs/channels/irc.md

LowScripts Present

LowEval

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings