TianyiDataScience/openclaw-control-center

Score 0. Found 12 critical, 7 high, 21 medium findings.

Trust score

0/ 100

Score 0. Found 12 critical, 7 high, 21 medium findings.

TianyiDataScience/openclaw-control-center · 50 of 189 files read

Critical12

scripts/run-tests-isolated.ts:42 · shell_exec
Spawns a subprocess.
```
const child = spawn(
```

scripts/ensure-playwright.js:20 · shell_exec

Spawns a subprocess.

execFileSync(npmCommand(), ["install", "--no-save", "playwright"], {

scripts/ensure-playwright.js:58 · shell_exec

Spawns a subprocess.

execFileSync(process.execPath, [cliPath, "install", "chromium"], {

scripts/stall-auto-heal.ts:43 · shell_exec
Spawns a subprocess.
```
const child = spawn("npm", ["run", "lock:release"], {
```

scripts/ui-smoke.js:23 · shell_exec

Spawns a subprocess.

const child = spawn(process.execPath, ["--import", "tsx", "src/index.ts"], {

scripts/evidence-reporter.ts:46 · shell_exec

Spawns a subprocess.

const child = spawn(process.execPath, ["--import", "tsx", scriptPath, ...args], {

scripts/watchdog-orchestrator.ts:76 · shell_exec

Spawns a subprocess.

const child = spawn(process.execPath, ["--import", "tsx", scriptPath, ...args], {

scripts/resident-worker.ts:124 · shell_exec
Spawns a subprocess.
```
const child = spawn(command, args, {
```
+ 4 more

High7

scripts/ui-smoke.js:40 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
function fetch(urlPath) {
```
scripts/ui-smoke.js:56 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
await fetch("/healthz");
```
scripts/ui-smoke.js:72 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const body = await fetch(urlPath);
```
scripts/ui-smoke.js:86 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const body = await fetch(urlPath);
```
scripts/export-staff-avatars.ts:50 · shell_exec
Runs untrusted code in a vm context.
```
const runtime = vm.runInNewContext(
```
scripts/hall-release-smoke.ts:13 · secret_in_code
Possible hardcoded credential literal.
```
const SMOKE_LOCAL_TOKEN = "hall-smoke-local-token";
```
scripts/hall-release-smoke.ts:42 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(`${baseUrl}/healthz`);
```

Medium21

scripts/health-snapshot.ts:47 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(out, JSON.stringify(snapshot, null, 2) + "\n", "utf8");
```
scripts/evidence-gate.ts:48 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(path, `${JSON.stringify(bundle, null, 2)}\n`, "utf8");
```
scripts/validate-task-store.ts:13 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(
```
scripts/validate-task-store.ts:26 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(
```
scripts/periodic-snapshot.ts:24 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, "utf8");
```
scripts/stall-auto-heal.ts:60 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(auditPath, `${old}${line}\n`, "utf8");
```
scripts/stall-auto-heal.ts:99 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`, "utf8");
```
scripts/ui-smoke.js:22 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
const logStream = fs.createWriteStream(LOG_FILE);
```
+ 13 more