MalDet · Static Security Report
This repository shows severe security issues that are likely caused by malicious intent rather than just poor coding habits, as indicated by the Critical scores of 584.0 and 317.0 from automated tools like Bandit and YARA. The most concerning findings involve dangerous patterns such as recursive file deletion, dynamic code loading for execution, and cryptocurrency mining activity, which pose immediate threats to system stability and data integrity. Additionally, there are multiple hardcoded passwords and messaging platform tokens that could be exploited to steal sensitive information or bypass security controls. While some issues like URL schemes and XML parsing vulnerabilities appear less critical, the presence of these malicious patterns suggests the codebase is actively compromised rather than just containing standard bugs.
Written by a language model running locally on the scanning machine, from the findings in this report. The risk levels above and below were decided by the scoring model, not by this summary.
MalDet scores two different questions separately, because they call for different responses: code can be badly written without being hostile, and hostile code is not always badly written.
| Detector | Looks for | High | Medium | Low | Total |
|---|---|---|---|---|---|
| bandit | Insecure coding patterns in Python source | 0 | 309 | 961 | 1,270 |
| yara | Signatures of malicious behaviour in source files | 63 | 0 | 77 | 140 |
| guarddog | Malicious package and install-time behaviour | 23 | 15 | 10 | 48 |
| dep_checker | Vulnerable, unpinned or typosquatted dependencies | 0 | 0 | 8 | 8 |
73 of 1,466 findings were rated more likely genuine than noise by the classifier.
Identical findings are grouped, so a single rule firing many times takes one row. Ordered worst first. “Seen” is how many times that finding occurred.
| Severity | Detector | Finding | Seen | Example location |
|---|---|---|---|---|
| high | guarddog | Detects suspicious autostart persistence mechanisms [threat-filesystem-autostart] | 3 | /dashboard.py:1758 |
| high | guarddog | Detects dynamic code loading: downloading and importing/executing code at runtime [threat-runtime-dynamic-loader] | 3 | /clawmetry/sync.py:931 |
| high | guarddog | Detects destructive operations (recursive deletion, wiping) [threat-filesystem-destruction] | 2 | /clawmetry/framework_map.py:197 |
| high | guarddog | Detects URLs to suspicious domains often used for exfiltration or C2 [threat-network-exfiltration] | 5 | /routes/alerts.py:1166 |
| high | guarddog | Detects system info collection combined with network exfiltration (hostname/user in HTTP requests) [threat-network-exfil-sysinfo] | 3 | /dashboard.py:3128 |
| high | guarddog | Detects hardcoded messaging platform tokens/webhooks used for data exfiltration [threat-network-exfil-messenger] | 3 | /clawmetry/incident_alerts.py:360 |
| high | guarddog | Detects cryptocurrency mining activity [threat-process-cryptomining] | 3 | /dashboard.py:10065 |
| high | guarddog | Detects access to sensitive files (credentials, configs, keys) [threat-filesystem-read] | 5 | /clawmetry/detector_behaviour.py:186 |
| high | guarddog | Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec] | 3 | /dashboard.py:3128 |
| high | yara | YARA rule matched: detect_crypto_miner — Cryptocurrency mining pool connection patterns | 1 | /dashboard.py |
| high | yara | YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA c | 10 | /install.sh |
| high | yara | YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone | 39 | /clawmetry/detector_behaviour.py |
| high | yara | YARA rule matched: detect_obfuscated_string_execution — Reconstructs a string character-by-character or from hex escapes, then immediately executes it - fromCharCode/chr() alone are common in ordinary text-processing code, so this requires both the reconstruction and an execution call together | 2 | /clawmetry/static/v2/dist/assets/index-CrUi8oj9.js |
| high | yara | YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this | 11 | /install-clawmetry.sh |
| medium | guarddog | Detects extensive system/network enumeration activities [threat-runtime-enumeration] | 3 | /dashboard.py:1800 |
| medium | guarddog | Detects URLs to URL shorteners, file sharing, and suspicious services [threat-network-outbound-shady-links] | 5 | /clawmetry/briefs.py:364 |
| medium | bandit | Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected. | 116 | /clawmetry/license.py:901 |
| medium | bandit | Possible SQL injection vector through string-based query construction. | 191 | /clawmetry/local_store.py:2712 |
| medium | bandit | Probable insecure usage of temp file/directory. | 2 | /dashboard.py:12595 |
| low | bandit | Using escape to parse untrusted XML data is known to be vulnerable to XML attacks. Replace escape with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 3 | /clawmetry/cli.py:1790 |
| low | bandit | Possible hardcoded password: '[CMPII:' | 1 | /clawmetry/assessment_privacy.py:29 |
| low | bandit | Possible hardcoded password: 'tokens consumed by this sub-agent' | 1 | /clawmetry/dives_prompt.py:178 |
| low | bandit | Possible hardcoded password: 'total tokens consumed on this day' | 1 | /clawmetry/dives_prompt.py:118 |
| low | bandit | Possible hardcoded password: 'guard.last_pass_ms' | 1 | /clawmetry/guard_checks.py:10 |
| low | bandit | Possible hardcoded password: 'count_over_threshold' | 1 | /clawmetry/alert_evaluator.py:74 |
| low | bandit | Possible hardcoded password: 'first_pass_rate_below' | 1 | /clawmetry/alert_evaluator.py:102 |
| low | bandit | Possible hardcoded password: 'CLAW1' | 1 | /clawmetry/license.py:73 |
| low | bandit | Possible hardcoded password: 'ok' | 1 | /scripts/redteam/audit.py:399 |
| low | bandit | Possible hardcoded password: 'ok ' | 1 | /scripts/redteam/audit.py:471 |
| low | bandit | Possible hardcoded password: '2.0' | 2 | /routes/usage.py:2476 |
| low | bandit | Possible hardcoded password: '[ OK ]' | 1 | /clawmetry/doctor.py:26 |
| low | bandit | Possible hardcoded password: 'token_spike' | 1 | /routes/alerts.py:350 |
| low | bandit | Possible hardcoded password: 'sum of token counts on deduped call events in the window' | 1 | /routes/usage.py:357 |
| low | guarddog | Detects active collection of system information (hostname, platform, architecture, user) [threat-runtime-system-info] | 3 | /clawmetry/cli.py:414 |
| low | guarddog | Detects reading of environment variables (credential access, often contains secrets) [threat-runtime-environment-read] | 1 | /.github/scripts/visual-diff.mjs:49 |
| low | guarddog | Detects memory scraping and credential dumping from process memory [threat-process-memory] | 3 | /clawmetry/process_control.py:815 |
| low | bandit | Possible hardcoded password: '[WITHHELD:secret]' | 1 | /clawmetry/assessment_privacy.py:28 |
| low | bandit | Possible hardcoded password: 'recorded token usage; verify interval, cumulative and cache basis before summing' | 1 | /clawmetry/dives_prompt.py:79 |
| low | guarddog | Detects fully silent process execution (suppressing all output channels) [threat-process-spawn-silent] | 3 | /clawmetry/process_control.py:893 |
| low | bandit | Possible hardcoded password: 'PASS' | 2 | /scripts/accuracy_harness/keystone_e2e.py:79 |
| low | bandit | Possible hardcoded password: '0' | 2 | /clawmetry/sync.py:13967 |
| low | bandit | Possible hardcoded password: 'pass' | 1 | /clawmetry/repo_readiness.py:67 |
| low | bandit | Using xml.etree.ElementTree to parse untrusted XML data is known to be vulnerable to XML attacks. Replace xml.etree.ElementTree with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called. | 1 | /scripts/auto_quarantine.py:41 |
| low | bandit | Possible hardcoded password: '' | 15 | /dashboard.py:2702 |
| low | bandit | Possible hardcoded password: 'None' | 7 | /clawmetry/adapters/nemo.py:497 |
| low | bandit | Starting a process without a shell. | 2 | /clawmetry/sync.py:25467 |
| low | bandit | Try, Except, Continue detected. | 232 | /clawmetry/capability_gaps.py:321 |
| low | bandit | Consider possible security implications associated with the subprocess module. | 140 | /clawmetry/process_control.py:1316 |
| low | bandit | Starting a process with a partial executable path | 202 | /scripts/pr_provenance_demo.py:39 |
| low | dep_checker | Loose version constraint: 'certifi>=2024.7.4 # CA bundle: the trust-store fallback for 3.8/3.9 and for any interpreter with no CA store. Floor is the first release that drops the distrusted GLOBALTRUST root (CVE-2024-39689); same requires_python (' — attacker could push malicious update | 1 | requirements.txt:4 |
| low | bandit | subprocess call - check for execution of untrusted input. | 316 | /clawmetry/daemon_registration.py:173 |
| low | dep_checker | Loose version constraint: 'zstandard>=0.25.0; python_version < "3.14" # decodes OpenClaw 2026.9.x zstd transcript events (stdlib from 3.14)' — attacker could push malicious update | 1 | requirements.txt:5 |
| low | dep_checker | Loose version constraint: 'truststore>=0.10.4; python_version' — attacker could push malicious update | 1 | requirements.txt:3 |
| low | dep_checker | Loose version constraint: 'duckdb>=1.5.6 # local event store (epic #964 phase 1)' — attacker could push malicious update | 1 | requirements.txt:2 |
| low | dep_checker | Loose version constraint: 'requests>=2.34.2' — attacker could push malicious update | 1 | requirements.txt:10 |
| low | dep_checker | Loose version constraint: 'pytest>=9.1.1' — attacker could push malicious update | 1 | requirements.txt:8 |
| low | dep_checker | Loose version constraint: 'pytest-playwright>=0.9.0' — attacker could push malicious update | 1 | requirements.txt:9 |
| low | dep_checker | Loose version constraint: 'flask>=3.1.3,<4' — attacker could push malicious update | 1 | requirements.txt:1 |
| low | yara | YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version | 77 | /scripts/verify_runtime_filtering.py |
| low | bandit | Use of assert detected. The enclosed code will be removed when compiling to optimised byte code. | 22 | /desktop/smoke_windows_cleanup.py:72 |