security-monitor
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The script scripts/monitor.cjs executes several system commands using child_process.execSync, including tail for system logs, ss and netstat for network ports, ps for processes, and docker for container status.
- [CREDENTIALS_UNSAFE]: The monitoring script accesses highly sensitive file paths. It reads /var/log/auth.log and /var/log/syslog for login attempts. It also explicitly reads credential-bearing environment files at /root/clawd/skills/.env and /root/clawd/.env to scan for specific API key markers such as TWITTER and KAPSO.
Recommendations
- AI detected serious security threats
Audit Metadata