OpenClaw Language Boundary

• Analyzed: May 19, 2026, 1:47 AM
• Findings: 4
• Version: 0.1.4
• Reason codes:
  suspicious.dangerous_execsuspicious.exposed_secret_literal
• Engine: v2.4.24

Overview

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Findings (4)

critical

suspicious.dangerous_exec

• Location: scripts/release-check.ts:116
• Finding: Shell command execution detected (child_process).

Evidence

execFileSync(cmd, args, { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 180_000 });

critical

suspicious.dangerous_exec

• Location: scripts/reliability-smoke.ts:105
• Finding: Shell command execution detected (child_process).

Evidence

const stdout = execFileSync(cmd, args, { cwd: opts.cwd, encoding: "utf8", timeout: opts.timeoutMs ?? 10_000, stdio: ["ignore", "pipe", "pipe"] });

critical

suspicious.exposed_secret_literal

• Location: tests/boundaries.test.ts:11
• Finding: File appears to expose a hardcoded API secret or token.

Evidence

const decision = decideOutboundMessage({ content: "api_key=[REDACTED]" }, config);

critical

suspicious.exposed_secret_literal

• Location: tests/enforce-rollout.test.ts:73
• Finding: File appears to expose a hardcoded API secret or token.

Evidence

const decision = decideOutboundMessage({ content: "api_key=[REDACTED]" }, config);