lov-clash-tun-doctor
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The Python script
scripts/clash_tun_doctor.pyuses thesubprocess.runmodule to interact with the macOS operating system. These interactions are limited to managing the Clash Verge application lifecycle, specifically usingosascriptto gracefully quit the application,pgrepto check for running processes, andopento restart the application. All commands use hardcoded or safely derived values. - [DATA_EXPOSURE]: The skill accesses local application data, including configuration files (
config.yaml,profiles.yaml) and service logs (service_latest.log), located in the user's~/Library/Application Support/directory. This access is necessary for identifying routing failures and IPv6 configuration issues as part of its primary troubleshooting function. The data is processed locally and is not transmitted to external servers. - [SAFE]: The skill follows security best practices for automation tools. It implements a mandatory backup mechanism before modifying any configuration files, uses an explicit
--applyflag to prevent accidental changes, and performs runtime verification to ensure repairs are successful and do not leave the system in an unstable state. It relies exclusively on the Python standard library, avoiding third-party dependency risks.
Audit Metadata