whitzard-claw 1.0.0

package/scripts/check/network_exposure.sh

@@ -0,0 +1,479 @@
+# shellcheck shell=bash
+
+export PATH="$HOME/.local/bin:/opt/homebrew/opt/node@22/bin:/opt/homebrew/bin:/usr/local/bin:$PATH"
+
+# ------------------------------------------------------------
+# Shared helpers
+# ------------------------------------------------------------
+
+OPENCLAW_PRESENT=false
+if command -v openclaw >/dev/null 2>&1; then
+    OPENCLAW_PRESENT=true
+fi
+
+OC_VERSION="unknown"
+PARSED_OC_VERSION=""
+OC_MAJOR=""
+OC_MINOR=""
+OC_PATCH=""
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    OC_VERSION="$(run_with_timeout 5 openclaw --version 2>/dev/null || echo "unknown")"
+    PARSED_OC_VERSION="$(echo "$OC_VERSION" | grep -oE '[0-9]{4}\.[0-9]+\.[0-9]+' | head -1 || true)"
+    if [ -n "$PARSED_OC_VERSION" ]; then
+        OC_MAJOR="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f1)"
+        OC_MINOR="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f2)"
+        OC_PATCH="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f3)"
+    fi
+fi
+
+get_oc_config() {
+    # Usage: get_oc_config <key> <default>
+    local key="$1"
+    local default_val="${2:-}"
+    if [ "$OPENCLAW_PRESENT" = true ]; then
+        run_with_timeout 10 openclaw config get "$key" 2>/dev/null || echo "$default_val"
+    else
+        echo "$default_val"
+    fi
+}
+
+normalize_config_val() {
+    # Normalize null/undefined-ish values to empty string
+    local val="${1:-}"
+    case "$val" in
+        null|undefined|"")
+            echo ""
+            ;;
+        *)
+            echo "$val"
+            ;;
+    esac
+}
+
+version_ge() {
+    # Usage: version_ge <major> <minor> <patch>
+    # returns 0 if OC_VERSION >= target, else 1
+    local t_major="$1"
+    local t_minor="$2"
+    local t_patch="$3"
+
+    if [ -z "$PARSED_OC_VERSION" ]; then
+        return 1
+    fi
+
+    if [ "$OC_MAJOR" -gt "$t_major" ] 2>/dev/null; then
+        return 0
+    fi
+    if [ "$OC_MAJOR" -lt "$t_major" ] 2>/dev/null; then
+        return 1
+    fi
+
+    if [ "$OC_MINOR" -gt "$t_minor" ] 2>/dev/null; then
+        return 0
+    fi
+    if [ "$OC_MINOR" -lt "$t_minor" ] 2>/dev/null; then
+        return 1
+    fi
+
+    if [ "$OC_PATCH" -ge "$t_patch" ] 2>/dev/null; then
+        return 0
+    fi
+
+    return 1
+}
+
+version_lt() {
+    # Usage: version_lt <major> <minor> <patch>
+    # returns 0 if OC_VERSION < target, else 1
+    if [ -z "$PARSED_OC_VERSION" ]; then
+        return 1
+    fi
+    if version_ge "$1" "$2" "$3"; then
+        return 1
+    fi
+    return 0
+}
+
+detect_gateway_port() {
+    local raw
+    raw="$(get_oc_config "gateway.port" "18789")"
+    raw="$(echo "$raw" | grep -oE '[0-9]+' | head -1 || true)"
+    if [ -z "$raw" ]; then
+        raw="18789"
+    fi
+    echo "$raw"
+}
+
+GW_PORT="$(detect_gateway_port)"
+
+# ============================================================
+# CHECK 1 (origin 13): Gateway Security Configuration
+# ============================================================
+header 1 "Auditing gateway security configuration..."
+
+GW_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    log "  OpenClaw version: $OC_VERSION"
+
+    BIND="$(get_oc_config "gateway.bind" "unknown")"
+    if [ "$BIND" = "lan" ] || [ "$BIND" = "0.0.0.0" ]; then
+        result_warn "Gateway bound to LAN ($BIND) - accessible from network"
+        GW_ISSUES=$((GW_ISSUES + 1))
+    fi
+
+    AUTH_MODE="$(get_oc_config "gateway.auth.mode" "unknown")"
+    if [ "$AUTH_MODE" = "none" ] || [ "$AUTH_MODE" = "off" ]; then
+        result_critical "Gateway authentication is disabled"
+        GW_ISSUES=$((GW_ISSUES + 1))
+    fi
+else
+    log "  openclaw command not found"
+fi
+
+if [ "$GW_ISSUES" -eq 0 ]; then
+    result_clean "Gateway configuration acceptable"
+fi
+
+# ============================================================
+# CHECK 2 (origin 14): WebSocket Origin Validation
+# ============================================================
+header 2 "Checking WebSocket security (CVE-2026-25253)..."
+
+if command -v curl >/dev/null 2>&1; then
+    WS_RAW="$(curl -s -o /dev/null -w "%{http_code}" \
+        -H "Connection: Upgrade" \
+        -H "Upgrade: websocket" \
+        -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
+        -H "Sec-WebSocket-Version: 13" \
+        -H "Origin: http://evil.attacker.com" \
+        --connect-timeout 3 --max-time 5 \
+        "http://127.0.0.1:${GW_PORT}/" 2>/dev/null || echo "000")"
+    WS_TEST="$(echo "$WS_RAW" | head -c 3)"
+else
+    WS_TEST="000"
+fi
+
+if [ "$WS_TEST" = "101" ]; then
+    PATCHED_WS=false
+    if version_ge 2026 2 0; then
+        PATCHED_WS=true
+    elif version_ge 2026 1 29; then
+        PATCHED_WS=true
+    fi
+
+    HAS_GW_AUTH="$(get_oc_config "gateway.auth.mode" "")"
+    if [ "$PATCHED_WS" = true ] && [ -n "$HAS_GW_AUTH" ] && [ "$HAS_GW_AUTH" != "none" ] && [ "$HAS_GW_AUTH" != "off" ]; then
+        result_clean "WebSocket: v$OC_VERSION patched + gateway auth ($HAS_GW_AUTH) - CVE-2026-25253 mitigated"
+    elif [ "$PATCHED_WS" = true ]; then
+        result_warn "WebSocket: v$OC_VERSION patched but gateway auth is weak/missing"
+    else
+        result_critical "Gateway accepts WebSocket from arbitrary origins (CVE-2026-25253 may be unpatched)"
+    fi
+elif [ "$WS_TEST" = "000" ]; then
+    log "  Gateway not reachable on port $GW_PORT (may be normal)"
+    result_clean "WebSocket test inconclusive (gateway not reachable)"
+elif [ "$WS_TEST" = "403" ] || [ "$WS_TEST" = "401" ]; then
+    result_clean "WebSocket origin validation active (HTTP $WS_TEST rejected)"
+else
+    result_clean "WebSocket responded HTTP $WS_TEST"
+fi
+
+# ============================================================
+# CHECK 3 (origin 25): Reverse Proxy / Localhost Trust Bypass
+# ============================================================
+header 3 "Checking for reverse proxy localhost trust bypass..."
+
+PROXY_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    BIND_ADDR="$(get_oc_config "gateway.bind" "")"
+    TRUSTED_PROXIES="$(get_oc_config "gateway.trustedProxies" "")"
+    DISABLE_DEVICE_AUTH="$(get_oc_config "gateway.dangerouslyDisableDeviceAuth" "")"
+
+    if [ "$DISABLE_DEVICE_AUTH" = "true" ]; then
+        result_critical "Device authentication is disabled (dangerouslyDisableDeviceAuth=true)"
+        PROXY_ISSUES=$((PROXY_ISSUES + 1))
+    fi
+
+    if [ "$BIND_ADDR" = "lan" ] || [ "$BIND_ADDR" = "0.0.0.0" ]; then
+        if [ -z "$TRUSTED_PROXIES" ] || [ "$TRUSTED_PROXIES" = "null" ] || [ "$TRUSTED_PROXIES" = "[]" ]; then
+            result_warn "Gateway on LAN without trustedProxies - localhost trust bypass risk"
+            PROXY_ISSUES=$((PROXY_ISSUES + 1))
+        fi
+    fi
+fi
+
+if [ "$PROXY_ISSUES" -eq 0 ]; then
+    result_clean "No reverse proxy bypass risk"
+fi
+
+# ============================================================
+# CHECK 4 (origin 33): ClawJacked Brute-Force Protection
+# ============================================================
+header 4 "Checking ClawJacked brute-force protection..."
+
+CLAWJACKED_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    if [ -n "$PARSED_OC_VERSION" ]; then
+        CLAWJACKED_SAFE=false
+        if version_ge 2026 3 0; then
+            CLAWJACKED_SAFE=true
+        elif version_ge 2026 2 26; then
+            CLAWJACKED_SAFE=true
+        fi
+
+        if [ "$CLAWJACKED_SAFE" = false ]; then
+            result_critical "OpenClaw v$OC_VERSION vulnerable to ClawJacked (WebSocket brute-force). Update to v2026.2.26+"
+            CLAWJACKED_ISSUES=$((CLAWJACKED_ISSUES + 1))
+        fi
+    else
+        result_warn "Could not parse OpenClaw version from: $OC_VERSION"
+        CLAWJACKED_ISSUES=$((CLAWJACKED_ISSUES + 1))
+    fi
+
+    GW_AUTH_TOKEN="$(get_oc_config "gateway.auth.token" "")"
+    if [ -z "$GW_AUTH_TOKEN" ] || [ "$GW_AUTH_TOKEN" = "null" ]; then
+        result_warn "No gateway auth token set (ClawJacked can brute-force weak/default credentials more easily)"
+        CLAWJACKED_ISSUES=$((CLAWJACKED_ISSUES + 1))
+    fi
+
+    RATE_LIMIT="$(get_oc_config "gateway.auth.rateLimit" "")"
+    if [ "$RATE_LIMIT" = "off" ] || [ "$RATE_LIMIT" = "false" ]; then
+        result_warn "Gateway auth rate limiting is disabled (enables brute-force attacks)"
+        CLAWJACKED_ISSUES=$((CLAWJACKED_ISSUES + 1))
+    fi
+fi
+
+if [ "$CLAWJACKED_ISSUES" -eq 0 ]; then
+    result_clean "ClawJacked protections in place"
+fi
+
+# ============================================================
+# CHECK 5 (origin 41): Browser Relay CDP Unauthenticated Access
+# ============================================================
+header 5 "Checking Browser Relay CDP auth (CVE-2026-28458)..."
+
+CDP_ISSUES=0
+
+if command -v lsof >/dev/null 2>&1; then
+    CDP_LISTEN="$(lsof -iTCP:18792 -sTCP:LISTEN -nP 2>/dev/null | grep -v '^COMMAND' || true)"
+    if [ -n "$CDP_LISTEN" ]; then
+        log "  Browser Relay is listening on port 18792"
+        if [ -n "$PARSED_OC_VERSION" ]; then
+            if version_lt 2026 2 1; then
+                result_critical "Browser Relay /cdp endpoint may be unauthenticated (CVE-2026-28458). Update to v2026.2.1+"
+                CDP_ISSUES=$((CDP_ISSUES + 1))
+            fi
+        fi
+    fi
+fi
+
+if [ "$CDP_ISSUES" -eq 0 ]; then
+    result_clean "Browser Relay CDP auth acceptable"
+fi
+
+# ============================================================
+# CHECK 6 (origin 31): Internet Exposure Detection
+# ============================================================
+header 6 "Checking for internet exposure of gateway..."
+
+EXPOSURE_ISSUES=0
+
+if command -v lsof >/dev/null 2>&1; then
+    GW_LISTEN="$(lsof -i ":${GW_PORT}" -nP 2>/dev/null | grep LISTEN | awk '{print $9}' | head -5 || true)"
+    if [ -n "$GW_LISTEN" ]; then
+        NON_LOCAL="$(echo "$GW_LISTEN" | grep -vE '127\.0\.0\.1|localhost|\[::1\]' || true)"
+        if [ -n "$NON_LOCAL" ]; then
+            result_warn "Gateway listening on non-loopback interface"
+            log "$GW_LISTEN"
+            EXPOSURE_ISSUES=$((EXPOSURE_ISSUES + 1))
+        fi
+
+        WILDCARD="$(echo "$GW_LISTEN" | grep '\*:' || true)"
+        if [ -n "$WILDCARD" ]; then
+            result_warn "Gateway bound to all interfaces (*:$GW_PORT) - potentially internet-exposed"
+            EXPOSURE_ISSUES=$((EXPOSURE_ISSUES + 1))
+        fi
+    fi
+fi
+
+if [ "$EXPOSURE_ISSUES" -eq 0 ]; then
+    result_clean "Gateway not exposed to external network"
+fi
+
+# ============================================================
+# CHECK 7 (origin 20): mDNS/Bonjour Exposure
+# ============================================================
+header 7 "Checking mDNS/Bonjour discovery settings..."
+
+MDNS_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    MDNS_MODE="$(get_oc_config "discovery.mdns.mode" "")"
+    if [ "$MDNS_MODE" = "full" ]; then
+        result_warn "mDNS broadcasting in 'full' mode (exposes paths, SSH port)"
+        MDNS_ISSUES=$((MDNS_ISSUES + 1))
+    elif [ -n "$MDNS_MODE" ]; then
+        log "  mDNS mode: $MDNS_MODE"
+    fi
+fi
+
+if [ "$MDNS_ISSUES" -eq 0 ]; then
+    result_clean "mDNS configuration acceptable"
+fi
+
+# ============================================================
+# CHECK 8 (origin 34): SSRF Protection
+# ============================================================
+header 8 "Checking SSRF protections (CVE-2026-26322, CVE-2026-27488)..."
+
+SSRF_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    if [ -n "$PARSED_OC_VERSION" ]; then
+        if version_lt 2026 2 14; then
+            result_critical "OpenClaw v$OC_VERSION vulnerable to gateway SSRF (CVE-2026-26322) and cron SSRF (CVE-2026-27488). Update to v2026.2.19+"
+            SSRF_ISSUES=$((SSRF_ISSUES + 1))
+        elif version_lt 2026 2 19; then
+            result_warn "OpenClaw v$OC_VERSION vulnerable to cron webhook SSRF (CVE-2026-27488). Update to v2026.2.19+"
+            SSRF_ISSUES=$((SSRF_ISSUES + 1))
+        fi
+    fi
+
+    CRON_CONFIG="$(get_oc_config "cron" "")"
+    if echo "$CRON_CONFIG" | grep -qiE '169\.254\.|127\.0\.0\.1|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|metadata\.google|metadata\.aws'; then
+        result_warn "Cron webhook targets internal/metadata endpoints (SSRF risk)"
+        SSRF_ISSUES=$((SSRF_ISSUES + 1))
+    fi
+fi
+
+if [ "$SSRF_ISSUES" -eq 0 ]; then
+    result_clean "SSRF protections acceptable"
+fi
+
+# ============================================================
+# CHECK 9 (origin 36): ACP Permission Auto-Approval
+# ============================================================
+header 9 "Checking ACP auto-approval bypass (GHSA-7jx5)..."
+
+ACP_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    if [ -n "$PARSED_OC_VERSION" ]; then
+        if version_lt 2026 2 23; then
+            result_warn "OpenClaw v$OC_VERSION vulnerable to GHSA-7jx5 (ACP auto-approval bypass). Update to v2026.2.23+"
+            ACP_ISSUES=$((ACP_ISSUES + 1))
+        fi
+    fi
+
+    ACP_AUTO="$(get_oc_config "acp.autoApprove" "")"
+    if [ "$ACP_AUTO" = "true" ] || [ "$ACP_AUTO" = "all" ]; then
+        result_warn "ACP auto-approve is enabled (tool calls bypass interactive approval)"
+        ACP_ISSUES=$((ACP_ISSUES + 1))
+    fi
+fi
+
+if [ "$ACP_ISSUES" -eq 0 ]; then
+    result_clean "ACP permission controls acceptable"
+fi
+
+# ============================================================
+# CHECK 10 (origin 39/45): Deep Link + Sandbox Browser Bridge
+# ============================================================
+header 10 "Checking deep link truncation and sandbox browser bridge auth..."
+
+LOCAL_BRIDGE_ISSUES=0
+
+# ---- Deep link truncation (origin 39)
+if [ "$(uname -s)" = "Darwin" ]; then
+    if [ -n "$PARSED_OC_VERSION" ] && version_lt 2026 2 14; then
+        result_warn "OpenClaw v$OC_VERSION vulnerable to deep link truncation (CVE-2026-26320). Update to v2026.2.14+"
+        LOCAL_BRIDGE_ISSUES=$((LOCAL_BRIDGE_ISSUES + 1))
+    fi
+
+    if [ -d "$LOG_DIR" ]; then
+        LONG_LINKS="$(grep -rl 'openclaw://' "$LOG_DIR" 2>/dev/null | head -3 || true)"
+        if [ -n "$LONG_LINKS" ]; then
+            while IFS= read -r lfile; do
+                [ -z "$lfile" ] && continue
+                if grep -E 'openclaw://[^ ]{240,}' "$lfile" >/dev/null 2>&1; then
+                    result_warn "Long deep link (>240 chars) found in logs - possible CVE-2026-26320 exploit attempt"
+                    LOCAL_BRIDGE_ISSUES=$((LOCAL_BRIDGE_ISSUES + 1))
+                    break
+                fi
+            done <<EOF
+$LONG_LINKS
+EOF
+        fi
+    fi
+else
+    log "  Not macOS, skipping deep-link truncation check"
+fi
+
+# ---- Sandbox browser bridge auth bypass (origin 45)
+if [ -n "$PARSED_OC_VERSION" ] && version_lt 2026 2 14; then
+    result_warn "Sandbox browser bridge may be unauthenticated (CVE-2026-28468). Update to v2026.2.14+"
+    LOCAL_BRIDGE_ISSUES=$((LOCAL_BRIDGE_ISSUES + 1))
+fi
+
+if [ "$LOCAL_BRIDGE_ISSUES" -eq 0 ]; then
+    result_clean "Deep link and sandbox browser bridge protections acceptable"
+fi
+
+# ============================================================
+# CHECK 11 (new / GW-003): Weak gateway auth token/password
+# ============================================================
+header 11 "Checking gateway auth token/password strength..."
+
+GW_WEAK_AUTH_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    AUTH_MODE="$(normalize_config_val "$(get_oc_config "gateway.auth.mode" "")")"
+
+    GW_AUTH_TOKEN_CANDIDATE="$(normalize_config_val "$(get_oc_config "gateway.auth.token" "")")"
+    GW_AUTH_PASSWORD_CANDIDATE="$(normalize_config_val "$(get_oc_config "gateway.auth.password" "")")"
+    GW_AUTH_LEGACY_CANDIDATE="$(normalize_config_val "$(get_oc_config "gateway.authToken" "")")"
+
+    GW_AUTH_SECRET=""
+    if [ -n "$GW_AUTH_TOKEN_CANDIDATE" ]; then
+        GW_AUTH_SECRET="$GW_AUTH_TOKEN_CANDIDATE"
+    elif [ -n "$GW_AUTH_PASSWORD_CANDIDATE" ]; then
+        GW_AUTH_SECRET="$GW_AUTH_PASSWORD_CANDIDATE"
+    elif [ -n "$GW_AUTH_LEGACY_CANDIDATE" ]; then
+        GW_AUTH_SECRET="$GW_AUTH_LEGACY_CANDIDATE"
+    fi
+
+    if [ "$AUTH_MODE" = "token" ] || [ "$AUTH_MODE" = "password" ]; then
+        GW_SECRET_LEN="$(printf "%s" "$GW_AUTH_SECRET" | wc -c | tr -d ' ' || echo "0")"
+        if [ "$GW_SECRET_LEN" -gt 0 ] 2>/dev/null && [ "$GW_SECRET_LEN" -lt 32 ] 2>/dev/null; then
+            result_warn "Weak gateway authentication token/password (${GW_SECRET_LEN} chars). Minimum 32 recommended"
+            GW_WEAK_AUTH_ISSUES=$((GW_WEAK_AUTH_ISSUES + 1))
+        fi
+    fi
+fi
+
+if [ "$GW_WEAK_AUTH_ISSUES" -eq 0 ]; then
+    result_clean "Gateway auth token/password length acceptable"
+fi
+
+# ============================================================
+# CHECK 12 (new / GW-006): Gateway TLS enabled
+# ============================================================
+header 12 "Checking whether gateway TLS is enabled..."
+
+GW_TLS_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    GW_TLS_ENABLED="$(normalize_config_val "$(get_oc_config "gateway.tls.enabled" "")")"
+    if [ "$GW_TLS_ENABLED" != "true" ]; then
+        result_warn "TLS not enabled on gateway (gateway.tls.enabled is not true) - credentials and traffic may be sent in plaintext"
+        GW_TLS_ISSUES=$((GW_TLS_ISSUES + 1))
+    fi
+fi
+
+if [ "$GW_TLS_ISSUES" -eq 0 ]; then
+    result_clean "Gateway TLS is enabled"
+fi

package/scripts/check/resource_cost.sh

@@ -0,0 +1,182 @@
+# shellcheck shell=bash
+
+# ------------------------------------------------------------
+# Shared helpers
+# ------------------------------------------------------------
+
+OPENCLAW_PRESENT=false
+if command -v openclaw >/dev/null 2>&1; then
+    OPENCLAW_PRESENT=true
+fi
+
+OC_VERSION="unknown"
+PARSED_OC_VERSION=""
+OC_MAJOR=""
+OC_MINOR=""
+OC_PATCH=""
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+    OC_VERSION="$(run_with_timeout 5 openclaw --version 2>/dev/null || echo "unknown")"
+    PARSED_OC_VERSION="$(echo "$OC_VERSION" | grep -oE '[0-9]{4}\.[0-9]+\.[0-9]+' | head -1 || true)"
+
+    if [ -n "$PARSED_OC_VERSION" ]; then
+        OC_MAJOR="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f1)"
+        OC_MINOR="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f2)"
+        OC_PATCH="$(echo "$PARSED_OC_VERSION" | cut -d'.' -f3)"
+    fi
+fi
+
+version_ge() {
+
+    local t_major="$1"
+    local t_minor="$2"
+    local t_patch="$3"
+
+    if [ -z "$PARSED_OC_VERSION" ]; then
+        return 1
+    fi
+
+    if [ "$OC_MAJOR" -gt "$t_major" ] 2>/dev/null; then
+        return 0
+    fi
+    if [ "$OC_MAJOR" -lt "$t_major" ] 2>/dev/null; then
+        return 1
+    fi
+
+    if [ "$OC_MINOR" -gt "$t_minor" ] 2>/dev/null; then
+        return 0
+    fi
+    if [ "$OC_MINOR" -lt "$t_minor" ] 2>/dev/null; then
+        return 1
+    fi
+
+    if [ "$OC_PATCH" -ge "$t_patch" ] 2>/dev/null; then
+        return 0
+    fi
+
+    return 1
+}
+
+version_lt() {
+
+    if [ -z "$PARSED_OC_VERSION" ]; then
+        return 1
+    fi
+
+    if version_ge "$1" "$2" "$3"; then
+        return 1
+    fi
+
+    return 0
+}
+
+# ------------------------------------------------------------
+# Cron frequency check
+# ------------------------------------------------------------
+
+has_high_freq_cron() {
+
+grep -Eq '^[[:space:]]*(\*[[:space:]]+\*[[:space:]]+\*[[:space:]]+\*[[:space:]]+\*|\*/[1-4][[:space:]]+\*[[:space:]]+\*[[:space:]]+\*[[:space:]]+\*)' "$1" 2>/dev/null
+
+}
+
+TOTAL_TOKENS=0
+TOTAL_COST=0
+HOURLY_COST=0
+
+# ============================================================
+# CHECK 1: Webhook DoS
+# ============================================================
+
+header 1 "Checking webhook DoS / oversized payloads (CVE-2026-28478)..."
+
+WDOS_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+
+    if version_lt 2026 2 13; then
+
+        result_warn "Webhook handlers may lack strict body size/time limits (CVE-2026-28478). Update to v2026.2.13+"
+
+        WDOS_ISSUES=$((WDOS_ISSUES+1))
+    fi
+
+else
+
+    log "openclaw command not found"
+
+fi
+
+if [ "$WDOS_ISSUES" -eq 0 ]; then
+    result_clean "Webhook body limits acceptable"
+fi
+
+
+# ============================================================
+# CHECK 2: fetchWithGuard DoS
+# ============================================================
+
+header 2 "Checking fetchWithGuard memory DoS (CVE-2026-29609)..."
+
+FWG_ISSUES=0
+
+if [ "$OPENCLAW_PRESENT" = true ]; then
+
+    if version_lt 2026 2 14; then
+
+        result_warn "fetchWithGuard may be vulnerable to memory exhaustion DoS (CVE-2026-29609). Update to v2026.2.14+"
+
+        FWG_ISSUES=$((FWG_ISSUES+1))
+    fi
+
+else
+
+    log "openclaw command not found"
+
+fi
+
+if [ "$FWG_ISSUES" -eq 0 ]; then
+    result_clean "fetchWithGuard memory handling acceptable"
+fi
+
+
+# ============================================================
+# CHECK 3: High frequency cron
+# ============================================================
+
+header 3 "Checking high-frequency scheduled agent invocations (> every 5 minutes)..."
+
+CRON_ISSUES=0
+
+LOCAL_CRON_FILE="$OPENCLAW_DIR/crontab"
+
+if [ -f "$LOCAL_CRON_FILE" ]; then
+
+    if has_high_freq_cron "$LOCAL_CRON_FILE"; then
+
+        result_warn "High-frequency schedules found in $LOCAL_CRON_FILE (more often than every 5 minutes)"
+
+        CRON_ISSUES=$((CRON_ISSUES+1))
+    fi
+fi
+
+if command -v crontab >/dev/null 2>&1; then
+
+    TMP_CRON=$(mktemp)
+
+    if crontab -l >"$TMP_CRON" 2>/dev/null; then
+
+        if has_high_freq_cron "$TMP_CRON"; then
+
+            result_warn "High-frequency schedules found in user crontab (more often than every 5 minutes)"
+
+            CRON_ISSUES=$((CRON_ISSUES+1))
+        fi
+    fi
+
+    rm -f "$TMP_CRON"
+fi
+
+if [ "$CRON_ISSUES" -eq 0 ]; then
+    result_clean "No high-frequency scheduled invocations detected"
+fi