openclawx

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  apps/api/src/modules/assets/routes.ts, line 422

  fs.rmSync(assetRoot, { recursive: true, force: true });

  apps/api/src/modules/assets/routes.ts, line 493

  fs.rmSync(folder, { recursive: true, force: true });

  apps/api/src/modules/assets/routes.ts, line 497

  fs.rmSync(path.dirname(target), { recursive: true, force: true });

  Show more

  apps/api/src/modules/chat-mobile/https-proxy.test.ts, line 24

  t.after(() => fs.rmSync(root, { recursive: true, force: true }));

  apps/api/src/modules/chat-mobile/https-proxy.test.ts, line 41

  t.after(() => fs.rmSync(root, { recursive: true, force: true }));

  apps/api/src/modules/data/agent-query.test.ts, line 218

  e process.env.OPENCLAWX_DATA_DIR = old; fs.rmSync(dir, { recursive: true, force: true });

  apps/api/src/modules/data/app-project.test.ts, line 44

  } finally { db.close(); fs.rmSync(root, { recursive: true, force: true }); }

  apps/api/src/modules/data/app-project.test.ts, line 128

  fs.rmSync(root, { recursive: true, force: true });

• Install and update

  Note

  The docs document an installer that pipes a download into a shell.

  INSTALL_DOCUMENTED_INSTALLER

  apps/renderer/src/services/environment-remediation.ts, line 97

  'curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash',

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  apps/api/src/modules/chat-mobile/https-proxy.ts, line 83

  const upstream = http.request({

  apps/api/src/modules/chat-mobile/routes.ts, line 307

  const response=await fetch('/api/chat-mobile/'+encodeURIComponent(token)+'/state');

  apps/api/src/modules/chat-mobile/routes.ts, line 329

  const response=await fetch('/api/chat-mobile/'+encodeURIComponent(token)+'/messages',{

  Show more

  apps/api/src/modules/chat-mobile/routes.ts, line 343

  await fetch('/api/chat-mobile/'+encodeURIComponent(token)+'/cancel',{method:'POST'});

  apps/api/src/modules/chat-mobile/routes.ts, line 354

  const response=await fetch('/api/chat-mobile/'+encodeURIComponent(token)+'/new-session',{method:'POST'});

  apps/api/src/modules/chat-mobile/routes.ts, line 388

  const response=await fetch('/api/chat-mobile/'+encodeURIComponent(t

  apps/api/src/modules/chat-mobile/voice-ui.ts, line 33

  const response=await fetch(base+path,{method:body===undefined?'GET'

  apps/api/src/modules/chat-mobile/voice-ui.ts, line 47

  if(old)void fetch(base+'/'+encodeURIComponent(old)+'/close',{method:'POST',keepalive:true}).catch(()=>{});

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  apps/api/src/modules/auth/service.ts, line 188

  const internalExpected = String(process.env.OPENCLAWX_INTERNAL_TOKEN || '').trim();

  apps/api/src/modules/chat-mobile/routes.ts, line 516

  return { enabled: settings.enabled && Boolean(process.env.OPENCLAWX_VOLCENGINE_REALTIME_API_KEY?.trim() || settings.apiKey), workEnabled: settings.workLinkEnabled };

  .gitignore, line 11

  .env

  Show more

  apps/api/src/modules/data/database-secrets.test.ts, line 14

  if (process.env.OPENCLAWX_TEST_CREDENTIAL_CHILD === '1') {

  apps/api/src/modules/data/database-secrets.test.ts, line 16

  const value = await databaseSecret(process.env.OPENCLAWX_TEST_KEY!, process.env.OPENCLAWX_TEST_PASSWORD);

  apps/api/src/modules/data/database-secrets.test.ts, line 53

  const previous = process.env.OPENCLAWX_REQUIRE_DESKTOP_CREDENTIALS;

  apps/api/src/modules/data/database-secrets.test.ts, line 54

  process.env.OPENCLAWX_REQUIRE_DESKTOP_CREDENTIALS = '1';

  apps/api/src/modules/data/database-secrets.test.ts, line 56

  finally { if (previous === undefined) delete process.env.OPENCLAWX_REQUIRE_DESKTOP_CREDENTIALS; else process.env.OPENCLAWX_REQUIRE_DESKTOP_CREDENTIALS = previous; }

  apps/api/src/modules/data/database-secrets.ts, line 21

  export const databaseCredentialPersistence = () => process.send || bridge || process.env.OPENCLAWX_REQUIRE_DESKTOP_CREDENTIALS === '1' ? 'desktop' as const : 'session' as const;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  index-DMVj2k8H.js, line 1

  var xW=Object.defineProperty;var SW=(s,e,t)=>e in s?xW(s,e,{enumerable:!0,configurable:!0,writable:!0,value:t}):s[e]=t;var xn=(s,e,t)=>SW(s,typeof e!="symbol"?e+"":e,t);(function()

  pnpm-lock.yaml, line 1

  lockfileVersion: '9.0'

  docs/guides/images/user-manual-provider-auto-config.webp, line 1

  RIFF\
  WEBPVP8 P
  P��
  *@�>U*�G#�!�!��p

• Licence

  Note

  no licence file found.

  LICENCE_MISSING

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit da7bce121950. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read. no licence file found.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen