ironclaw

本页为离线静态分析自动生成；分数为信号驱动启发式，请结合证据与人工复核使用。

项目概况

• 名称: ironclaw
• 版本: 0.11.1
• Git HEAD: e9f32eaebea2
• 最近提交: 2026-02-24T15:29:25+08:00
• 语言: Rust(293), JSON(32), Markdown(31), TOML(16), YAML(8), Shell(7)

README 摘要

Your secure personal AI assistant, always on your side

评分（0-10）

维度	分数
代码质量	3.5
可维护性	6.5
健壮性	4.5
可持续性	6.5
可迁移性	2.0
综合	4.6

工程信号

CI / 测试

• CI: 6 个 workflow
  • .github/workflows/code_style.yml, .github/workflows/pr-label-classify.yml, .github/workflows/pr-label-scope.yml, .github/workflows/release-plz.yml, .github/workflows/release.yml, .github/workflows/test.yml
• CI 操作系统: linux
• Docker: 有
• 测试信号: dir:tests/

代码质量工具

• 校验库: rust:serde

安全与治理

• 治理: file:CONTRIBUTING.md

架构与发布

• 发布信号: ci-file:.github/workflows/release-plz.yml, ci-file:.github/workflows/release.yml, ci:publish:.github/workflows/release-plz.yml, ci:publish:.github/workflows/release.yml, ci:release:.github/workflows/release-plz.yml, ci:release:.github/workflows/release.yml …
• 可观测性: rust:tracing

技术栈与依赖

• Rust: name=ironclaw cargo_lock=True
  • deps: aes-gcm, aho-corasick, anyhow, async-trait, axum, base64, blake3, bollard, bytes, chrono, clap, clap_complete, cron, crossterm, deadpool-postgres, dirs …

评分依据（信号 → 证据）

代码质量

• +2 CI: 6 workflow(s)
• +2.5 tests: 1 signal(s)
• -1 risky code patterns present (review needed)

可维护性

• +1 README present
• +1 docs dirs: docs/
• +1 CHANGELOG present
• +1.5 governance: file:CONTRIBUTING.md
• +1 Cargo.lock present
• +1 CI present

健壮性

• +2 tests present
• +1 config signals: dir:docs/, file:.env.example
• +1 validation libs: rust:serde
• +0.5 retry/timeout libs (signals): rust:reqwest, rust:tokio
• +1 CI present
• -1 risky code patterns present (review needed)

可持续性

• +1 version: 0.11.1
• +1 CHANGELOG present
• +0.5 alerting/observability (signals): rust:tracing
• +1 release signals: ci-file:.github/workflows/release-plz.yml, ci-file:.github/workflows/release.yml, ci:publish:.github/workflows/release-plz.yml, ci:publish:.github/workflows/release.yml, ci:release:.github/workflows/release-plz.yml, ci:release:.github/workflows/release.yml
• +1 tags: 15 tag(s)
• +2 recent commit (≤30d)

可迁移性

• +2 Docker present

安全与风险信号（静态扫描）

疑似凭据（已编辑）

• Slack Token at tools-src/slack/README.md:74 value=***已编辑***
• GitHub PAT at src/safety/leak_detector.rs:548 value=***已编辑***
• AWS Access Key at src/safety/leak_detector.rs:563 value=***已编辑***
• OpenAI Key at src/safety/leak_detector.rs:638 value=***已编辑***
• AWS Access Key at src/safety/leak_detector.rs:644 value=***已编辑***
• GitHub PAT at src/safety/leak_detector.rs:644 value=***已编辑***
• AWS Access Key at src/safety/leak_detector.rs:675 value=***已编辑***
• GitHub PAT at src/safety/leak_detector.rs:691 value=***已编辑***

高风险模式（需人工复核）

• curl|bash (code) at Dockerfile.worker:49
• curl|bash (code) at src/tools/builtin/shell.rs:78
• wget|bash (code) at src/tools/builtin/shell.rs:79
• curl|bash (code) at src/tools/builtin/shell.rs:80
• wget|bash (code) at src/tools/builtin/shell.rs:81
• curl|bash (code) at src/tools/builtin/shell.rs:785
• curl|bash (code) at src/safety/policy.rs:168
• curl|bash (code) at src/safety/policy.rs:220
• 文档中的风险模式：1 条（curl|bash 等安装指引，通常为预期行为）
• curl|bash (config) at .github/workflows/release.yml:66
• curl|bash (config) at .github/workflows/release.yml:128

改进建议

• 在 CI 中启用 Rust 静态检查：cargo fmt --check + cargo clippy -D warnings。
• 补齐 License，明确使用与分发边界。
• 在 CI 增加安全扫描（依赖审计/secret 扫描/静态分析等）并设为质量闸门。
• 审计高风险执行路径（eval/exec/shell=True/curl|bash 等）：最小权限、输入验证、隔离执行。