Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

qingchencloud/clawpanel

https://github.com/qingchencloud/clawpanel · scanned 2026-05-15 17:15 UTC (2 weeks, 6 days ago) · 10 languages

182 findings (59 legacy + 123 scanner) 17th percentile · Javascript · medium (20-100K LoC) Scanner says 68 (lower by 16)

File as issue Image v2 schema
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 weeks, 6 days ago · v1 · 46 findings from 1 source. Findings combine the legacy security pipeline AND the multi-layer engine (atlas, wiring, flows, ranked) AND verified AI agent contributions.

JSON
Combined
64.1
/100
Repobility
60
46 legacy
9-layer
69
100.0% cov · 0 gaps
Critical
0
click to filter
Agents
6
0 votes
Crowd
0
reported
Score breakdown â 2026-05-17-v4 calibration-aware
Component Sub-score Weight Contribution
structure_score 85.0 0.15 12.75
security_score 41.6 0.25 10.40
testing_score 14.0 0.20 2.80
documentation_score 83.7 0.15 12.55
practices_score 75.0 0.15 11.25
code_quality 27.4 0.10 2.74
Overall 1.00 52.5
Calibrated penalty buckets (security_score): web: 3.0 · agent: 23.4 · docker: 6.5 · threat: 4.6 · journey: 21.0
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 33 Medium 7 Low 5 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Legacy 46 9-layer 0 Crowd 0 Layer: Quality 24 Software 12 Cicd 4 Security 6

All 2492 nodes from the latest scan, grouped by kind. Each node is a unit the engine identified (file, function, endpoint, table…). Most users won't need this view — it's primarily for debugging the engine's graph extraction or for AI agents that want to enumerate the project structure.

LabelLayerStatusPath
escapeRegExp software healthy scripts/sync-version.js:escapeRegExp
parseArgs software healthy scripts/serve.js:parseArgs
serveStatic software healthy scripts/serve.js:serveStatic
sendFile software healthy scripts/serve.js:sendFile
main software healthy scripts/serve.js:main
hermesProvider software healthy scripts/dev-api.js:hermesProvider
hermesHome software healthy scripts/dev-api.js:hermesHome
memoryFileName software healthy scripts/dev-api.js:memoryFileName
uvBinDir software healthy scripts/dev-api.js:uvBinDir
hermesEnhancedPath software healthy scripts/dev-api.js:hermesEnhancedPath
hermesGatewayPort software healthy scripts/dev-api.js:hermesGatewayPort
hermesGatewayUrl software healthy scripts/dev-api.js:hermesGatewayUrl
hermesGatewayCustomUrl software healthy scripts/dev-api.js:hermesGatewayCustomUrl
isLoopbackGatewayUrl software healthy scripts/dev-api.js:isLoopbackGatewayUrl
runHermesSilent software healthy scripts/dev-api.js:runHermesSilent
sanitizeHermesInstallOutput software healthy scripts/dev-api.js:sanitizeHermesInstallOutput
gitMirrorPrefix software healthy scripts/dev-api.js:gitMirrorPrefix
gitMirrorEnv software healthy scripts/dev-api.js:gitMirrorEnv
diagnoseHermesInstallError software healthy scripts/dev-api.js:diagnoseHermesInstallError
PANEL_VERSION software healthy scripts/dev-api.js:PANEL_VERSION
normalizeCustomOpenclawDir software healthy scripts/dev-api.js:normalizeCustomOpenclawDir
applyOpenclawPathConfig software healthy scripts/dev-api.js:applyOpenclawPathConfig
normalizeCliPath software healthy scripts/dev-api.js:normalizeCliPath
canonicalCliPath software healthy scripts/dev-api.js:canonicalCliPath
scanCliIdentity software healthy scripts/dev-api.js:scanCliIdentity
isRejectedCliPath software healthy scripts/dev-api.js:isRejectedCliPath
addCliCandidate software healthy scripts/dev-api.js:addCliCandidate
findCommandPath software healthy scripts/dev-api.js:findCommandPath
normalizeCommandPath software healthy scripts/dev-api.js:normalizeCommandPath
readConfiguredGitPath software healthy scripts/dev-api.js:readConfiguredGitPath
resolveGitExecutable software healthy scripts/dev-api.js:resolveGitExecutable
buildGitCommandEnv software healthy scripts/dev-api.js:buildGitCommandEnv
runGitSync software healthy scripts/dev-api.js:runGitSync
readConfiguredOpenclawSearchPaths software healthy scripts/dev-api.js:readConfiguredOpenclawSearchPaths
addConfiguredOpenclawCandidates software healthy scripts/dev-api.js:addConfiguredOpenclawCandidates
detectWindowsShimSource software healthy scripts/dev-api.js:detectWindowsShimSource
classifyCliSource software healthy scripts/dev-api.js:classifyCliSource
normalizeCliInstallSource software healthy scripts/dev-api.js:normalizeCliInstallSource
detectStandaloneSourceFromDir software healthy scripts/dev-api.js:detectStandaloneSourceFromDir
detectStandaloneSourceFromCliPath software healthy scripts/dev-api.js:detectStandaloneSourceFromCliPath
readVersionFromInstallation software healthy scripts/dev-api.js:readVersionFromInstallation
pkgNames software healthy scripts/dev-api.js:pkgNames
readWhereWhichOpenclawCandidates software healthy scripts/dev-api.js:readWhereWhichOpenclawCandidates
readWindowsNpmGlobalPrefix software healthy scripts/dev-api.js:readWindowsNpmGlobalPrefix
addCommonOpenclawCandidates software healthy scripts/dev-api.js:addCommonOpenclawCandidates
collectPreferredCliCandidates software healthy scripts/dev-api.js:collectPreferredCliCandidates
collectAllCliCandidates software healthy scripts/dev-api.js:collectAllCliCandidates
readBoundOpenclawCliPath software healthy scripts/dev-api.js:readBoundOpenclawCliPath
resolveOpenclawCliPath software healthy scripts/dev-api.js:resolveOpenclawCliPath
scanAllOpenclawInstallations software healthy scripts/dev-api.js:scanAllOpenclawInstallations

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
vite.config.js software warning vite.config.js
README.pt.md software healthy README.pt.md
README.ja.md software healthy README.ja.md
README.md software healthy README.md
README.es.md software healthy README.es.md
README.en.md software healthy README.en.md
README.ru.md software healthy README.ru.md
package.json software healthy package.json
index.html software healthy index.html
CONTRIBUTING.md software healthy CONTRIBUTING.md
openclaw-version-policy.json software healthy openclaw-version-policy.json
README.ko.md software healthy README.ko.md
Dockerfile software healthy Dockerfile
README.zh-TW.md software healthy README.zh-TW.md
deploy.sh software healthy deploy.sh
package-lock.json software healthy package-lock.json
build.sh software healthy build.sh
README.vi.md software healthy README.vi.md
README.fr.md software healthy README.fr.md
SECURITY.md software healthy SECURITY.md
CHANGELOG.md software healthy CHANGELOG.md
docker-compose.yml software healthy docker-compose.yml
README.de.md software healthy README.de.md
model-presets.test.js software warning tests/model-presets.test.js
gateway-guardian-policy.test.js software warning tests/gateway-guardian-policy.test.js
kernel.test.js software warning tests/kernel.test.js
docker-tasking.test.js software warning tests/docker-tasking.test.js
hermes-ui-refactor-plan.md software healthy docs/hermes-ui-refactor-plan.md
linux-deploy.md software healthy docs/linux-deploy.md
index.html software healthy docs/index.html
dingtalk-integration.md software healthy docs/dingtalk-integration.md
hermes-agent.md software healthy docs/hermes-agent.md
armbian-deploy.md software healthy docs/armbian-deploy.md
docker-deploy.md software healthy docs/docker-deploy.md
v2-cinematic.html software healthy docs/engine-select-mockups/v2-cinematic.html
index2.html software healthy docs/engine-select-mockups/index2.html
v2-monolith.html software healthy docs/engine-select-mockups/v2-monolith.html
mockup-a-minimal.html software healthy docs/engine-select-mockups/mockup-a-minimal.html
mockup-c-glass.html software healthy docs/engine-select-mockups/mockup-c-glass.html
index.html software healthy docs/engine-select-mockups/index.html
v2-bold-split.html software healthy docs/engine-select-mockups/v2-bold-split.html
v2-aurora.html software healthy docs/engine-select-mockups/v2-aurora.html
mockup-b-gradient.html software healthy docs/engine-select-mockups/mockup-b-gradient.html
latest.json software healthy docs/update/latest.json
dev.sh software healthy scripts/dev.sh
sync-version.js software healthy scripts/sync-version.js
linux-deploy.sh software healthy scripts/linux-deploy.sh
build.sh software healthy scripts/build.sh
serve.js software healthy scripts/serve.js
dev-api.js software healthy scripts/dev-api.js

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
/setup frontend healthy src/engines/hermes/pages/setup.js
/usage frontend healthy src/engines/hermes/pages/usage.js
/memory frontend healthy src/engines/hermes/pages/memory.js
/env-editor frontend healthy src/engines/hermes/pages/env-editor.js
/dashboard frontend healthy src/engines/hermes/pages/dashboard.js
/services frontend healthy src/engines/hermes/pages/services.js
/chat frontend healthy src/engines/hermes/pages/chat.js
/files frontend healthy src/engines/hermes/pages/files.js
/gateways frontend healthy src/engines/hermes/pages/gateways.js
/oauth frontend healthy src/engines/hermes/pages/oauth.js
/config frontend healthy src/engines/hermes/pages/config.js
/kanban frontend healthy src/engines/hermes/pages/kanban.js
/lazy-deps frontend healthy src/engines/hermes/pages/lazy-deps.js
/skills frontend healthy src/engines/hermes/pages/skills.js
/sessions frontend healthy src/engines/hermes/pages/sessions.js
/profiles frontend healthy src/engines/hermes/pages/profiles.js
/group-chat frontend healthy src/engines/hermes/pages/group-chat.js
/logs frontend healthy src/engines/hermes/pages/logs.js
/channels frontend healthy src/engines/hermes/pages/channels.js
/cron frontend healthy src/engines/hermes/pages/cron.js
/extensions frontend healthy src/engines/hermes/pages/extensions.js
/landing frontend healthy src/engines/xintian/pages/landing.js
/settings frontend healthy src/pages/settings.js
/models frontend healthy src/pages/models.js
/diagnose frontend healthy src/pages/diagnose.js
/assistant frontend healthy src/pages/assistant.js
/about frontend healthy src/pages/about.js
/engine-select frontend healthy src/pages/engine-select.js
/glossary frontend healthy src/pages/glossary.js
/dreaming frontend healthy src/pages/dreaming.js
/security frontend healthy src/pages/security.js
/notifications frontend healthy src/pages/notifications.js
/chat-debug frontend healthy src/pages/chat-debug.js
/gateway frontend healthy src/pages/gateway.js
/plugin-hub frontend healthy src/pages/plugin-hub.js
/communication frontend healthy src/pages/communication.js
/route-map frontend healthy src/pages/route-map.js
/agents frontend healthy src/pages/agents.js
/agent-detail frontend healthy src/pages/agent-detail.js
/h/setup frontend healthy src/engines/hermes/index.js
/h/dashboard frontend healthy src/engines/hermes/index.js
/h/chat frontend healthy src/engines/hermes/index.js
/h/group-chat frontend healthy src/engines/hermes/index.js
/h/oauth frontend healthy src/engines/hermes/index.js
/h/files frontend healthy src/engines/hermes/index.js
/h/sessions frontend healthy src/engines/hermes/index.js
/h/logs frontend healthy src/engines/hermes/index.js
/h/usage frontend healthy src/engines/hermes/index.js
/h/skills frontend healthy src/engines/hermes/index.js
/h/memory frontend healthy src/engines/hermes/index.js

Showing first 50 of this kind. Full payload available via the JSON button at the top of the page.

LabelLayerStatusPath
tests software healthy tests
docs software healthy docs
engine-select-mockups software healthy docs/engine-select-mockups
update software healthy docs/update
scripts software healthy scripts
lib software healthy scripts/lib
translations software healthy scripts/translations
ko software healthy scripts/translations/ko
pt software healthy scripts/translations/pt
es software healthy scripts/translations/es
ja software healthy scripts/translations/ja
fr software healthy scripts/translations/fr
de software healthy scripts/translations/de
vi software healthy scripts/translations/vi
ru software healthy scripts/translations/ru
src-tauri software healthy src-tauri
gen software healthy src-tauri/gen
schemas software healthy src-tauri/gen/schemas
capabilities software healthy src-tauri/capabilities
src software healthy src-tauri/src
models software healthy src-tauri/src/models
commands software healthy src-tauri/src/commands
public software healthy public
.github software healthy .github
ISSUE_TEMPLATE software healthy .github/ISSUE_TEMPLATE
workflows software healthy .github/workflows
src software healthy src
engines software healthy src/engines
openclaw software healthy src/engines/openclaw
hermes software healthy src/engines/hermes
lib software healthy src/engines/hermes/lib
pages software healthy src/engines/hermes/pages
style software healthy src/engines/hermes/style
xintian software healthy src/engines/xintian
pages software healthy src/engines/xintian/pages
style software healthy src/engines/xintian/style
components software healthy src/components
lib software healthy src/lib
locales software healthy src/locales
modules software healthy src/locales/modules
pages software healthy src/pages
style software healthy src/style

LabelLayerStatusPath
auth::src/lib/openclaw-kb.js security healthy src/lib/openclaw-kb.js
auth::src/engines/hermes/pages/setup.js security healthy src/engines/hermes/pages/setup.js
auth::src/locales/modules/models.js security healthy src/locales/modules/models.js
auth::src/lib/term-tooltip.js security healthy src/lib/term-tooltip.js
auth::src/locales/pt.json security healthy src/locales/pt.json
auth::src-tauri/src/commands/hermes_providers.rs security healthy src-tauri/src/commands/hermes_providers.rs
auth::src/locales/ja.json security healthy src/locales/ja.json
auth::src/locales/zh-CN.json security healthy src/locales/zh-CN.json
auth::src/locales/de.json security healthy src/locales/de.json
auth::src/locales/ko.json security healthy src/locales/ko.json
auth::src/locales/ru.json security healthy src/locales/ru.json
auth::src/locales/es.json security healthy src/locales/es.json
auth::src-tauri/src/commands/config.rs security healthy src-tauri/src/commands/config.rs
auth::src/engines/hermes/lib/providers.js security healthy src/engines/hermes/lib/providers.js
auth::src/locales/fr.json security healthy src/locales/fr.json
auth::src/pages/glossary.js security healthy src/pages/glossary.js
auth::src/locales/modules/engine.js security healthy src/locales/modules/engine.js
auth::src/locales/vi.json security healthy src/locales/vi.json
auth::scripts/dev-api.js security healthy scripts/dev-api.js
auth::src/locales/en.json security healthy src/locales/en.json
auth::src/engines/hermes/pages/oauth.js security healthy src/engines/hermes/pages/oauth.js
auth::src/engines/hermes/index.js security healthy src/engines/hermes/index.js
auth::src/locales/modules/channels.js security healthy src/locales/modules/channels.js
auth::src/locales/zh-TW.json security healthy src/locales/zh-TW.json
auth::src/pages/assistant.js security healthy src/pages/assistant.js
auth::src-tauri/src/commands/hermes.rs security healthy src-tauri/src/commands/hermes.rs

LabelLayerStatusPath
APPLE_PASSWORD cicd healthy —
APPLE_ID cicd healthy —
APPLE_CERTIFICATE_PASSWORD cicd healthy —
APPLE_TEAM_ID cicd healthy —
GITHUB_TOKEN cicd healthy —
APPLE_CERTIFICATE cicd healthy —
TAG_NAME cicd healthy —
TAURI_SIGNING_PRIVATE_KEY_PASSWORD cicd healthy —
TAURI_SIGNING_PRIVATE_KEY cicd healthy —
APPLE_SIGNING_IDENTITY cicd healthy —

LabelLayerStatusPath
port:1420 network healthy vite.config.js
port:21420 network healthy tests/docker-tasking.test.js
port:8080 network healthy scripts/serve.js
port:18789 network healthy scripts/dev-api.js
port:9119 network healthy scripts/dev-api.js

LabelLayerStatusPath
password_literal::scripts/linux-deploy.sh security healthy scripts/linux-deploy.sh
password_literal::scripts/dev-api.js security healthy scripts/dev-api.js
password_literal::scripts/dev-api.js security healthy scripts/dev-api.js
password_literal::scripts/dev-api.js security healthy scripts/dev-api.js
password_literal::src/pages/security.js security healthy src/pages/security.js

LabelLayerStatusPath
127.0.0.1 network healthy vite.config.js
1.2.3.4 network healthy tests/kernel.test.js
192.168.1.100 network healthy src/engines/hermes/pages/dashboard.js
192.168.1.20 network healthy src/pages/services.js

LabelLayerStatusPath
check cicd healthy .github/workflows/ci.yml
build cicd healthy .github/workflows/release.yml
update-release-notes cicd healthy .github/workflows/release.yml

LabelLayerStatusPath
swap software healthy src/engines/hermes/pages/chat.js:swap
WsClient software healthy src/lib/ws-client.js:WsClient

LabelLayerStatusPath
image::Dockerfile hardware healthy Dockerfile
clawpanel hardware healthy docker-compose.yml

LabelLayerStatusPath
vps::azure hardware healthy scripts/dev-api.js
vps::aws hardware healthy scripts/dev-api.js

LabelLayerStatusPath
gha::ci cicd healthy .github/workflows/ci.yml
gha::release cicd healthy .github/workflows/release.yml

LabelLayerStatusPath
repobility-clone-1g3gg6sq software healthy /tmp/repobility-clone-1g3gg6sq

LabelLayerStatusPath
GET api healthy src/pages/chat.js

LabelLayerStatusPath
sqlite data healthy src/lib/api-compat.js

LabelLayerStatusPath
gpu (detected) hardware healthy scripts/dev-api.js
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/efdecec6-e2ef-4fec-829e-1a8beb5bdd4d/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/efdecec6-e2ef-4fec-829e-1a8beb5bdd4d/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.