Security: Claudeclaw

Vulnerabilities

Credential Leaks

FAIL

Quality Gate

OWASP Grade

17.5h

Tech Debt (D)

High

DORA Rating

⚡

AI Fix Prompts

Auto-generated prompts to fix every issue — copy into Claude, GPT, or any AI coder

View AI Prompts

Want this analysis on your repo? https://repobility.com/scan/

Quality Gate: Default Gate

Open data · scored by Repobility · https://repobility.com
	Metric	Condition
✗	overall_score	0.0 >= 50
✗	security_score	0.0 >= 40
✗	critical_vulnerabilities	4.0 <= 0
✓	critical_credentials	0.0 <= 0
✓	duplication_pct	0.9 <= 20

DORA Metrics

Same analyzer free for public repos: https://repobility.com
Deploy Frequency	unknown (0.0/week)
Lead Time	1.1 hours
MTTR	0.0 hours
Change Failure Rate	0.0%
Total Commits	29
Overall Rating	HIGH

Vulnerabilities (22)

Powered by Repobility · code-quality intelligence
Severity	ID	Package	Version	Summary
critical	`GHSA-hr2v-3952-633q`	deep-extend	-	Prototype Pollution in deep-extend
critical	`GHSA-g2q5-5433-rhrf`	rc	-	Embedded malware in rc
critical	`GHSA-wc9v-mj63-m9g5`	pg	-	Remote Code Execution in pg
critical	`GHSA-xvch-5gv4-984h`	minimist	-	Prototype Pollution in minimist
high	`GHSA-6663-c963-2gqg`	ws	-	DoS due to excessively large websocket message in ws
high	`GHSA-qqgx-2p2h-9c37`	ini	-	ini before 1.3.6 vulnerable to Prototype Pollution via ini.parse
high	`GHSA-wpg7-2c88-r8xv`	simple-get	-	Exposure of Sensitive Information in simple-get
high	`GHSA-8cj5-5rvv-wf4v`	tar-fs	-	tar-fs can extract outside the specified dir with a specific tarball
high	`GHSA-pq67-2wwv-3xjx`	tar-fs	-	tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
high	`GHSA-vj76-c3g6-qr5v`	tar-fs	-	tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
high	`GHSA-x2mc-8fgj-3wmr`	tar-fs	-	Improper Input Validation in tar-fs
high	`GHSA-3h5v-q93c-6h6q`	ws	-	ws affected by a DoS when handling a request with many HTTP headers
high	`GHSA-5v72-xg48-5rpm`	ws	-	Denial of Service in ws
high	`GHSA-c2qf-rxjj-qqgw`	semver	-	semver vulnerable to Regular Expression Denial of Service
high	`GHSA-x6fg-f45m-jf5q`	semver	-	Regular Expression Denial of Service in semver
medium	`GHSA-pp7h-53gx-mx7r`	bl	-	Remote Memory Exposure in bl
medium	`GHSA-6fc8-4gx4-v693`	ws	-	ReDoS in Sec-Websocket-Protocol header
medium	`GHSA-xc7v-wxcw-j472`	tunnel-agent	-	Memory Exposure in tunnel-agent
medium	`GHSA-wrw9-m778-g6mc`	bl	-	Memory Exposure in bl
medium	`GHSA-vh95-rmgr-6w4m`	minimist	-	Prototype Pollution in minimist
low	`GHSA-c6rq-rjc2-86v2`	chownr	-	Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
low	`GHSA-2mhh-w6q8-5hxw`	ws	-	Remote Memory Disclosure in ws

Credential Findings (4)

Generated by the Repobility scanner · https://repobility.com
Severity	Pattern	File	Line
high	[sast:aljefra/taint-path-traversal] Path Traversal via Tainted Data	`Opus46/lib/files.js`	90
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`Opus46/public/sw.js`	24
high	[sast:aljefra/ssrf-http-client] SSRF via HTTP Client with Dynamic URL	`Opus46/public/sw.js`	30
high	Telegram Bot Token	`telegram-claude-bridge.js`	11

Export

SARIF SBOM (CycloneDX) SBOM (SPDX) Vulns CSV Generate AI Fix Prompts (5)