vivekchand / clawmetry

Large result: showing the top 396 of 1,466 findings (up to 200 per engine, most severe and most likely real first). Totals above include everything.

1. high GuardDog Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] /dashboard.py:1758 99%
2. high GuardDog Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader] /clawmetry/sync.py:931 99%
3. high GuardDog Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader] /clawmetry/sync.py:15386 99%
4. high GuardDog Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader] /clawmetry/sync.py:1331 99%
5. high GuardDog Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction] /clawmetry/framework_map.py:197 99%
6. high GuardDog Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] /dashboard.py:1372 99%
7. high GuardDog Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo] /dashboard.py:3128 98%
8. high GuardDog Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo] /dashboard.py:11953 98%
9. high GuardDog Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo] /dashboard.py:12943 98%
10. high GuardDog Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction] /clawmetry/cli.py:2270 98%
11. high GuardDog Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] /dashboard.py:13413 98%
12. high GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /dashboard.py:10693 98%
13. high GuardDog Detects hardcoded messaging platform tokens/webhooks used for data exfiltration [threat-network-exfil-messenger] /clawmetry/incident_alerts.py:360 97%
14. high GuardDog Detects hardcoded messaging platform tokens/webhooks used for data exfiltration [threat-network-exfil-messenger] /routes/alerts.py:1166 97%
15. high GuardDog Detects hardcoded messaging platform tokens/webhooks used for data exfiltration [threat-network-exfil-messenger] /clawmetry/briefs.py:364 97%
16. high GuardDog Detects cryptocurrency mining activity [threat-process-cryptomining] /dashboard.py:10062 97%
17. high GuardDog Detects cryptocurrency mining activity [threat-process-cryptomining] /dashboard.py:10065 97%
18. high GuardDog Detects cryptocurrency mining activity [threat-process-cryptomining] /dashboard.py:10063 97%
19. high GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /dashboard.py:10011 96%
20. high GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /dashboard.py:10013 96%
21. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /dashboard.py:11953 95%
22. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /dashboard.py:3128 95%
23. high GuardDog Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] /dashboard.py:12207 95%
24. high YARA YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns /dashboard.py 36%
25. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /scripts/check_action_refs.py 33%
26. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /scripts/auto_quarantine.py 33%
27. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /scripts/apply_required_status_checks.py 33%
28. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /install.sh 33%
29. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /.claude/sf_client.py 33%
30. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /scripts/e2e_gate.py 33%
31. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /dashboard.py 33%
32. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /clawmetry/providers/turso.py 33%
33. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /.github/workflows/c6-apply-ruleset.yml 33%
34. high YARA YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md /.github/workflows/c6-health.yml 33%
35. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/trace_capture.py 1%
36. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /install-clawmetry.sh 1%
37. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/adapters/openclaw.py 1%
38. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/incident_alerts.py 1%
39. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/license.py 1%
40. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/detector_behaviour.py 1%
41. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/repo_scan.py 1%
42. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /dashboard.py 1%
43. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /desktop/app.py 1%
44. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /desktop/onboarding.py 1%
45. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /PRD-pr-trace.md 1%
46. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /desktop/tray.py 1%
47. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/secure.py 1%
48. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawhub-plugin/uninstall.sh 1%
49. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawhub-plugin/README.md 1%
50. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/assistant_service.py 1%
51. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/approvals.py 1%
52. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /routes/advisor.py 1%
53. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /routes/update_check.py 1%
54. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /routes/trial.py 1%
55. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /routes/overview.py 1%
56. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /helpers/gateway.py 1%
57. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/cli.py 1%
58. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/sync.py 1%
59. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.github/workflows/ci.yml 1%
60. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /FLYWHEEL.md 1%
61. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /clawmetry/static/js/app.js 1%
62. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /CHANGELOG.md 1%
63. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /README.md 1%
64. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/pr_trace_join.py 1%
65. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/verify_otel_recipe_langgraph.py 1%
66. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/verify_published_wheel.py 1%
67. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/canary_verify.py 1%
68. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/accuracy_harness/keystone_e2e.py 1%
69. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /install.sh 1%
70. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/accuracy_harness/_lib.py 1%
71. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/accuracy_harness/README.md 1%
72. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /.claude/sf_client.py 1%
73. high YARA YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone /scripts/verify_selfhosted_image.py 1%
74. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /clawmetry/static/vendor/marked.min.js 1%
75. high YARA YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together /clawmetry/static/v2/dist/assets/index-CrUi8oj9.js 1%
76. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawmetry/watchdog.py 0%
77. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawhub-plugin/uninstall.sh 0%
78. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawhub-plugin/install.sh 0%
79. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawmetry/daemon_registration.py 0%
80. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawmetry/security_posture.py 0%
81. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /dashboard.py 0%
82. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawmetry/fleet_install.py 0%
83. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /install.sh 0%
84. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /install-clawmetry.sh 0%
85. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /routes/update_check.py 0%
86. high YARA YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this /clawmetry/cli.py 0%
87. medium GuardDog Detects extensive system/network enumeration activities [threat-runtime-enumeration] /dashboard.py:7031 98%
88. medium GuardDog Detects extensive system/network enumeration activities [threat-runtime-enumeration] /dashboard.py:1800 98%
89. medium GuardDog Detects extensive system/network enumeration activities [threat-runtime-enumeration] /dashboard.py:7073 98%
90. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /clawmetry/briefs.py:364 98%
91. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /clawmetry/incident_alerts.py:360 98%
92. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /routes/alerts.py:1166 98%
93. medium GuardDog Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] /routes/alerts.py:1673 98%
94. medium GuardDog Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] /dashboard.py:10693 97%
95. medium GuardDog Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] /clawmetry/briefs.py:364 97%
96. medium GuardDog Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] /clawmetry/briefs.py:364 97%
97. medium GuardDog Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] /clawmetry/briefs.py:364 97%
98. medium GuardDog Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] /dashboard.py:7117 97%
99. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /clawmetry/cli.py:7689 96%
100. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /clawmetry/detector_behaviour.py:186 96%
101. medium GuardDog Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] /clawmetry/detector_behaviour.py:186 96%
102. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /.claude/sf_client.py:54 49%
103. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/adapters/nemo.py:772 49%
104. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/onboarding.py:1580 49%
105. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:10696 49%
106. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:11940 49%
107. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:12852 49%
108. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:13010 49%
109. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/app.py:596 49%
110. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/app.py:1633 49%
111. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/app.py:1671 49%
112. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/app.py:1994 49%
113. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/onboarding.py:324 49%
114. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/onboarding.py:496 49%
115. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/onboarding.py:1482 49%
116. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:8052 49%
117. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/tray.py:163 49%
118. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /desktop/tray.py:169 49%
119. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /integrations/nat/clawmetry_nat/exporter.py:253 49%
120. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/advisor.py:458 49%
121. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/alerts.py:1677 49%
122. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/alerts.py:1695 49%
123. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/channels.py:2385 49%
124. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/channels.py:2397 49%
125. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/local_query.py:108 49%
126. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/meta.py:387 49%
127. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/meta.py:1122 49%
128. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/security_posture.py:310 49%
129. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/insights.py:652 49%
130. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/instrument.py:149 49%
131. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/license.py:549 49%
132. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/license.py:901 49%
133. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/license.py:1005 49%
134. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/mcp_server.py:82 49%
135. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/narrator.py:177 49%
136. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/pr_provenance.py:1022 49%
137. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/providers/turso.py:65 49%
138. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/proxy.py:2514 49%
139. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/secure.py:164 49%
140. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/overview.py:1998 49%
141. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:1757 49%
142. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:7534 49%
143. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:8008 49%
144. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:9315 49%
145. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:25402 49%
146. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/sync.py:28463 49%
147. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/telemetry.py:232 49%
148. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/trace_capture.py:350 49%
149. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/trace_capture.py:417 49%
150. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:7117 49%
151. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:1704 49%
152. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/incident_alerts.py:339 49%
153. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/incident_alerts.py:148 49%
154. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/doctor.py:386 49%
155. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cursor_connector.py:199 49%
156. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:8015 49%
157. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:7965 49%
158. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:5732 49%
159. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:4865 49%
160. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:4223 49%
161. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:3171 49%
162. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:2744 49%
163. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/insights.py:614 49%
164. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:23 49%
165. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/claude_code_gate.py:747 49%
166. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/briefs.py:328 49%
167. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/attention_hook.py:90 49%
168. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/assistant_service.py:203 49%
169. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/assistant_relay.py:254 49%
170. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/assistant_managed.py:125 49%
171. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/approvals.py:791 49%
172. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/approvals.py:687 49%
173. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/adapters/openclaw.py:509 49%
174. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/canary_verify.py:61 49%
175. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/overview.py:2084 49%
176. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/trial.py:127 49%
177. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/trial.py:413 49%
178. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/update_check.py:635 49%
179. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/accuracy_harness/_lib.py:56 49%
180. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/accuracy_harness/_lib.py:68 49%
181. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/accuracy_harness/_lib.py:80 49%
182. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/apply_required_status_checks.py:122 49%
183. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/auto_quarantine.py:105 49%
184. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/auto_quarantine.py:162 49%
185. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/canary_verify.py:48 49%
186. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/e2e_gate.py:350 49%
187. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/resolve_selfhosted_runtime_pins.py:99 49%
188. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/resolve_windows_pins.py:65 49%
189. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/vendor_fonts.py:107 49%
190. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_i18n_coverage.py:51 49%
191. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_otel_recipe_langgraph.py:73 49%
192. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_runtime_filtering.py:40 49%
193. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_selfhosted_image.py:140 49%
194. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_selfhosted_image.py:208 49%
195. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_vendor.py:66 49%
196. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/selfhosted.py:216 48%
197. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:1556 48%
198. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/proxy.py:1940 48%
199. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/trace.py:110 48%
200. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:3128 48%
201. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /dashboard.py:3308 48%
202. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/alerts.py:1177 48%
203. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /routes/overview.py:1909 48%
204. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/check_action_refs.py:147 48%
205. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/e2e_gate.py:397 48%
206. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/litellm_gateway_ci.py:62 48%
207. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/pr_trace_join.py:54 48%
208. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/spike_unexplained_descendants.py:87 48%
209. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /scripts/verify_otel_recipe_langgraph.py:117 48%
210. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/otel_exporter.py:289 48%
211. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/hooks_claude_code.py:687 48%
212. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/hooks_claude_code.py:394 48%
213. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/eval_runner.py:945 48%
214. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli_cmds/selfevolve.py:80 48%
215. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:8254 48%
216. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/cli.py:8173 48%
217. medium Bandit Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. /clawmetry/approvals.py:507 48%
218. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:2712 47%
219. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:2712 47%
220. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:14189 46%
221. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5266 46%
222. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigations.py:195 46%
223. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:214 46%
224. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:296 46%
225. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:297 46%
226. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:2708 46%
227. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:2836 46%
228. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:3228 46%
229. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:4956 46%
230. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5028 46%
231. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5108 46%
232. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5112 46%
233. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigations.py:173 46%
234. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5315 46%
235. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5374 46%
236. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5396 46%
237. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5459 46%
238. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5469 46%
239. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5729 46%
240. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:5839 46%
241. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:7203 46%
242. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:7263 46%
243. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:7334 46%
244. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:7442 46%
245. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:184 46%
246. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/adapters/openclaw_replay.py:338 46%
247. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/adapters/openclaw_replay.py:372 46%
248. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/agentops_metrics.py:333 46%
249. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/agentops_metrics.py:346 46%
250. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/agentops_metrics.py:352 46%
251. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/agentops_metrics.py:379 46%
252. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/agentops_metrics.py:404 46%
253. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/assistant_evidence.py:310 46%
254. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/assistant_evidence.py:339 46%
255. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/cohort_queries.py:93 46%
256. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/cohort_queries.py:117 46%
257. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:7969 46%
258. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:218 46%
259. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:273 46%
260. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:298 46%
261. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:323 46%
262. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:354 46%
263. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/incident_store.py:366 46%
264. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigation_catalog.py:20 46%
265. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigation_catalog.py:79 46%
266. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigations.py:135 46%
267. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigations.py:146 46%
268. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/investigations.py:163 46%
269. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:12649 46%
270. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:10352 46%
271. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:10632 46%
272. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:10895 46%
273. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:11026 46%
274. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:11132 46%
275. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:11239 46%
276. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:12014 46%
277. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:12127 46%
278. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:12228 46%
279. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:12312 46%
280. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:10366 46%
281. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:13207 46%
282. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:13262 46%
283. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:13577 46%
284. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:13879 46%
285. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:13890 46%
286. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:14571 46%
287. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/activity_store.py:144 46%
288. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/activity_store.py:112 46%
289. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/activity_store.py:70 46%
290. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:9253 46%
291. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8039 46%
292. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8090 46%
293. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8253 46%
294. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8381 46%
295. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8442 46%
296. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8712 46%
297. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:8745 46%
298. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:9123 46%
299. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:9204 46%
300. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:9261 46%
301. medium Bandit Possible SQL injection vector through string-based query construction. /clawmetry/local_store.py:10041 46%
302. low GuardDog Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] /dashboard.py:12943 93%
303. low GuardDog Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] /clawmetry/cli.py:414 93%
304. low GuardDog Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] /dashboard.py:12954 93%
305. low GuardDog Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] /.github/scripts/visual-diff.mjs:49 93%
306. low GuardDog Detects memory scraping and credential dumping from process memory [threat-process-memory] /clawmetry/process_control.py:815 92%
307. low GuardDog Detects memory scraping and credential dumping from process memory [threat-process-memory] /clawmetry/process_control.py:804 92%
308. low GuardDog Detects memory scraping and credential dumping from process memory [threat-process-memory] /clawmetry/process_control.py:518 92%
309. low GuardDog Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] /clawmetry/sync.py:8613 83%
310. low GuardDog Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] /clawmetry/process_control.py:922 83%
311. low GuardDog Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] /clawmetry/process_control.py:893 83%
312. low Dependency checker Loose version constraint: 'certifi>=2024.7.4 # CA bundle: the trust-store fallback for 3.8/3.9 and for any interpreter with no CA store. Floor is the first release that drops the distrusted GLOBALTRUST root (CVE-2024-39689); same requires_python (' — attacker could push malicious update requirements.txt:4 6%
313. low Dependency checker Loose version constraint: 'truststore>=0.10.4; python_version' — attacker could push malicious update requirements.txt:3 3%
314. low Dependency checker Loose version constraint: 'zstandard>=0.25.0; python_version < "3.14" # decodes OpenClaw 2026.9.x zstd transcript events (stdlib from 3.14)' — attacker could push malicious update requirements.txt:5 3%
315. low Dependency checker Loose version constraint: 'duckdb>=1.5.6 # local event store (epic #964 phase 1)' — attacker could push malicious update requirements.txt:2 2%
316. low Dependency checker Loose version constraint: 'pytest-playwright>=0.9.0' — attacker could push malicious update requirements.txt:9 2%
317. low Dependency checker Loose version constraint: 'pytest>=9.1.1' — attacker could push malicious update requirements.txt:8 2%
318. low Dependency checker Loose version constraint: 'requests>=2.34.2' — attacker could push malicious update requirements.txt:10 2%
319. low Dependency checker Loose version constraint: 'flask>=3.1.3,<4' — attacker could push malicious update requirements.txt:1 2%
320. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/doctor.py 0%
321. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/license.py 0%
322. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /integrations/nat/clawmetry_nat/exporter.py 0%
323. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/providers/turso.py 0%
324. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/eval_runner.py 0%
325. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/trace.py 0%
326. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/secure.py 0%
327. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/pr_provenance.py 0%
328. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/trace_capture.py 0%
329. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/security_posture.py 0%
330. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/assistant_stream.py 0%
331. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/telemetry.py 0%
332. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/cursor_connector.py 0%
333. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/assistant_relay.py 0%
334. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/adapters/openclaw.py 0%
335. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/incident_alerts.py 0%
336. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/narrator.py 0%
337. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/attention_hook.py 0%
338. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /CHANGELOG.md 0%
339. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /Dockerfile 0%
340. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/verify-published-wheel.yml 0%
341. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/c6-health.yml 0%
342. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.github/workflows/c6-apply-ruleset.yml 0%
343. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/sync.py 0%
344. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/cli.py 0%
345. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/overview.py 0%
346. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/local_query.py 0%
347. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/alerts.py 0%
348. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/meta.py 0%
349. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/assistant_service.py 0%
350. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/channels.py 0%
351. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/trial.py 0%
352. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/update_check.py 0%
353. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /routes/advisor.py 0%
354. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/instrument.py 0%
355. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/approvals.py 0%
356. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/url_guard.py 0%
357. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/mcp_server.py 0%
358. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/spike_unexplained_descendants.py 0%
359. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/pr_trace_join.py 0%
360. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/check_action_refs.py 0%
361. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/auto_quarantine.py 0%
362. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_otel_recipe_langgraph.py 0%
363. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_published_wheel.py 0%
364. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/canary_verify.py 0%
365. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/accuracy_harness/keystone_e2e.py 0%
366. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/resolve_selfhosted_runtime_pins.py 0%
367. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/resolve_windows_pins.py 0%
368. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/accuracy_harness/cloud_keystone_e2e.py 0%
369. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/apply_required_status_checks.py 0%
370. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/litellm_gateway_ci.py 0%
371. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /install.sh 0%
372. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/vendor_fonts.py 0%
373. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/accuracy_harness/_lib.py 0%
374. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/accuracy_harness/README.md 0%
375. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /.claude/sf_client.py 0%
376. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /deploy/self-hosted/Dockerfile.release 0%
377. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /deploy/self-hosted/docker-compose.yml 0%
378. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/cli_cmds/selfevolve.py 0%
379. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/hooks_claude_code.py 0%
380. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/adapters/nemo.py 0%
381. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/briefs.py 0%
382. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/claude_code_gate.py 0%
383. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/proxy.py 0%
384. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/selfhosted.py 0%
385. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/otel_exporter.py 0%
386. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/net.py 0%
387. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /dashboard.py 0%
388. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /clawmetry/insights.py 0%
389. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /desktop/app.py 0%
390. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /desktop/onboarding.py 0%
391. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /desktop/tray.py 0%
392. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_selfhosted_image.py 0%
393. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_runtime_filtering.py 0%
394. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_i18n_coverage.py 0%
395. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/verify_vendor.py 0%
396. low YARA YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version /scripts/e2e_gate.py 0%