Static repository check
- Checked commit
421b62cc046a- Evidence Score
- 68/100
- Static risk
- High risk
- Files scanned
- 5
- Findings
- 6
Evidence breakdown
Source provenance20/25
Install documentation25/25
Maintenance17/20
Compatibility evidence6/20
Security signals0/10
Compatibility confidence: Unknown
Install-time scripts (3)
postinstallnode scripts/setup-python.mjsdsh/package.json#postinstallnode scripts/setup-python.mjsopenclaw/package.json#postinstallnode scripts/setup-python.mjs
Findings (6)
- High
install.scriptdsh/package.jsoninstall-time"postinstall": "node scripts/setup-python.mjs" - High
install.scriptopenclaw/package.jsoninstall-time"postinstall": "node scripts/setup-python.mjs" - High
install.scriptpackage.jsoninstall-time"postinstall": "node scripts/setup-python.mjs" - Medium
obfuscation.child-processscripts/setup-python.mjs:2obfuscationimport { execSync } from "node:child_process"; - Medium
obfuscation.child-processscripts/setup-python.mjs:18obfuscationexecSync(cmd, { stdio: "pipe", timeout: 300_000 }); - Medium
obfuscation.child-processscripts/setup-python.mjs:24obfuscationconst ver = execSync(`${name} --version`, { stdio: "pipe" }).toString().trim();
Not run
- Dependency advisory database scan
- Installation execution test
- Runtime behavior verification
Scanner 1.0.0 · Scorer 1.0.0
