lovstudio-clash-tun-doctor
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/clash_tun_doctor.pyusessubprocess.runto manage the Clash Verge application state. Specifically, it usesosascriptto quit the application and theopencommand to restart it. These executions are restricted to a hardcoded application bundle name and do not utilize a shell, minimizing injection risks. - [DATA_EXPOSURE]: The skill reads local application configuration files (
config.yaml,profiles.yaml,clash-verge.yaml) and log files to diagnose connectivity issues. This access is limited to the local filesystem and the Mihomo runtime API via a Unix socket (/tmp/verge/verge-mihomo.sock). The skill instructions explicitly warn against outputting proxy secrets. - [SAFE]: The tool relies exclusively on the Python 3.8+ standard library and does not download or install external dependencies. All modifications to system configuration files include a dry-run preview and a timestamped backup mechanism for restoration.
Audit Metadata