lovstudio-clash-tun-doctor

Pass

Audited by Gen Agent Trust Hub on Jul 29, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/clash_tun_doctor.py uses subprocess.run to manage the Clash Verge application state. Specifically, it uses osascript to quit the application and the open command to restart it. These executions are restricted to a hardcoded application bundle name and do not utilize a shell, minimizing injection risks.
  • [DATA_EXPOSURE]: The skill reads local application configuration files (config.yaml, profiles.yaml, clash-verge.yaml) and log files to diagnose connectivity issues. This access is limited to the local filesystem and the Mihomo runtime API via a Unix socket (/tmp/verge/verge-mihomo.sock). The skill instructions explicitly warn against outputting proxy secrets.
  • [SAFE]: The tool relies exclusively on the Python 3.8+ standard library and does not download or install external dependencies. All modifications to system configuration files include a dry-run preview and a timestamped backup mechanism for restoration.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 29, 2026, 08:00 AM
Security Audit — agent-trust-hub — lovstudio-clash-tun-doctor