{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-cd2c507d0dd247bf", "name": "Possibly dead Python function: verify_plugin_registered", "shortDescription": {"text": "Possibly dead Python function: verify_plugin_registered"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be2a40a6dbfb5252", "name": "Dockerfile runs as root: docker/openclaw/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/openclaw/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0912f10d9e7c04b", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e69dfacc5b8efc9e", "name": "Dockerfile runs as root: docker/relay/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: docker/relay/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad53b6d26b900743", "name": "Docker base image is tag-pinned but not digest-pinned: rust:1.91-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.91-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1147fc9964f156e9", "name": "Possible secret in scripts/installer.py", "shortDescription": {"text": "Possible secret in scripts/installer.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-30dcfa72558e2ad1", "name": "Insecure pattern 'node_child_process' in src/wizard.ts:33", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/wizard.ts:33"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-733ce88ffe9ae9d5", "name": "Possible secret in src/telemetry.ts", "shortDescription": {"text": "Possible secret in src/telemetry.ts"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5ac8642d3fe4effb", "name": "Insecure pattern 'node_child_process' in src/update/preflight.ts:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/update/preflight.ts:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c7e7d1161d29c60d", "name": "Insecure pattern 'node_child_process' in src/update/apply.ts:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/update/apply.ts:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 39 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b40df6aee0a40393", "name": "Legacy-named symbol `write_local_dsn_copy` in scripts/publish_npm.py:51", "shortDescription": {"text": "Legacy-named symbol `write_local_dsn_copy` in scripts/publish_npm.py:51"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9eb45746772301dc", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/publish_npm.py:143", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/publish_npm.py:143"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4732c5843d4674f", "name": "Commented-code block (5 lines) in scripts/installer.py:561", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/installer.py:561"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aef200d371ae6168", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/installer.py:506", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/installer.py:506"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dff36b42f33cf4fa", "name": "Commented-code block (6 lines) in src/cli.ts:659", "shortDescription": {"text": "Commented-code block (6 lines) in src/cli.ts:659"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-edfb3ddd87236f28", "name": "Commented-code block (9 lines) in src/channel.ts:331", "shortDescription": {"text": "Commented-code block (9 lines) in src/channel.ts:331"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02fe323b38089b24", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/media.ts:47", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/media.ts:47"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-734fc21ddb25cc37", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/gateway-transport.ts:188", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/gateway-transport.ts:188"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b05bfd95abade865", "name": "Commented-code block (8 lines) in src/matrix/client.ts:340", "shortDescription": {"text": "Commented-code block (8 lines) in src/matrix/client.ts:340"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8df0cd46f7231073", "name": "Commented-code block (5 lines) in src/pairing/env.ts:21", "shortDescription": {"text": "Commented-code block (5 lines) in src/pairing/env.ts:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24906"}, "properties": {"repository": "chat4000/chat4000-openclaw-plugin", "repoUrl": "https://github.com/chat4000/chat4000-openclaw-plugin", "branch": "main"}, "results": [{"ruleId": "scanner-cd2c507d0dd247bf", "level": "note", "message": {"text": "Possibly dead Python function: verify_plugin_registered"}, "properties": {"repobilityId": "51dd3cc2c1fbe25a", "scanner": "scanner-primary", "fingerprint": "cd2c507d0dd247bf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/installer.py:596"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-be2a40a6dbfb5252", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/openclaw/Dockerfile"}, "properties": {"repobilityId": "1910bf108126d068", "scanner": "scanner-primary", "fingerprint": "be2a40a6dbfb5252", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-b0912f10d9e7c04b", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "82dc67186326af73", "scanner": "scanner-primary", "fingerprint": "b0912f10d9e7c04b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/openclaw/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e69dfacc5b8efc9e", "level": "warning", "message": {"text": "Dockerfile runs as root: docker/relay/Dockerfile"}, "properties": {"repobilityId": "30fdc0650db66396", "scanner": "scanner-primary", "fingerprint": "e69dfacc5b8efc9e", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ad53b6d26b900743", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: rust:1.91-slim"}, "properties": {"repobilityId": "82e33173ca8102b2", "scanner": "scanner-primary", "fingerprint": "ad53b6d26b900743", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/relay/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1147fc9964f156e9", "level": "error", "message": {"text": "Possible secret in scripts/installer.py"}, "properties": {"repobilityId": "8ee986367d5ee61b", "scanner": "scanner-primary", "fingerprint": "1147fc9964f156e9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/installer.py"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-30dcfa72558e2ad1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/wizard.ts:33"}, "properties": {"repobilityId": "ab9b627c2b04a622", "scanner": "scanner-primary", "fingerprint": "30dcfa72558e2ad1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/wizard.ts"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-733ce88ffe9ae9d5", "level": "error", "message": {"text": "Possible secret in src/telemetry.ts"}, "properties": {"repobilityId": "d0e15a10b33b82be", "scanner": "scanner-primary", "fingerprint": "733ce88ffe9ae9d5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/telemetry.ts"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-5ac8642d3fe4effb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/update/preflight.ts:19"}, "properties": {"repobilityId": "bd2c6e9ac8c463b5", "scanner": "scanner-primary", "fingerprint": "5ac8642d3fe4effb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/update/preflight.ts"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-c7e7d1161d29c60d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/update/apply.ts:20"}, "properties": {"repobilityId": "130731900322d805", "scanner": "scanner-primary", "fingerprint": "c7e7d1161d29c60d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/update/apply.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "17b5901c68ee16ad", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c1efb78ac70cabf1", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b40df6aee0a40393", "level": "note", "message": {"text": "Legacy-named symbol `write_local_dsn_copy` in scripts/publish_npm.py:51"}, "properties": {"repobilityId": "3ad3b5869cc37f6b", "scanner": "scanner-primary", "fingerprint": "b40df6aee0a40393", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9eb45746772301dc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/publish_npm.py:143"}, "properties": {"repobilityId": "15d46825af3fef5c", "scanner": "scanner-primary", "fingerprint": "9eb45746772301dc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c4732c5843d4674f", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/installer.py:561"}, "properties": {"repobilityId": "0f9b7752b4259804", "scanner": "scanner-primary", "fingerprint": "c4732c5843d4674f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aef200d371ae6168", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/installer.py:506"}, "properties": {"repobilityId": "3ebb12e6ba9e9a22", "scanner": "scanner-primary", "fingerprint": "aef200d371ae6168", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dff36b42f33cf4fa", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/cli.ts:659"}, "properties": {"repobilityId": "b9444ef57dcb22ad", "scanner": "scanner-primary", "fingerprint": "dff36b42f33cf4fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-edfb3ddd87236f28", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/channel.ts:331"}, "properties": {"repobilityId": "a175fee99e08fb32", "scanner": "scanner-primary", "fingerprint": "edfb3ddd87236f28", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-02fe323b38089b24", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/media.ts:47"}, "properties": {"repobilityId": "bec17cd2c1607484", "scanner": "scanner-primary", "fingerprint": "02fe323b38089b24", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-734fc21ddb25cc37", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/matrix/gateway-transport.ts:188"}, "properties": {"repobilityId": "efdddeb15a6c3578", "scanner": "scanner-primary", "fingerprint": "734fc21ddb25cc37", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b05bfd95abade865", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/matrix/client.ts:340"}, "properties": {"repobilityId": "b1f5eeab60e54071", "scanner": "scanner-primary", "fingerprint": "b05bfd95abade865", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8df0cd46f7231073", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/pairing/env.ts:21"}, "properties": {"repobilityId": "9c3554dbd04413de", "scanner": "scanner-primary", "fingerprint": "8df0cd46f7231073", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}