False positive: ClawScan claims @liseman/openclaw-louter 0.2.8 ships Python bytecode, but artifact contains none

Summary

ClawHub's ClawScan marks the published code plugin @liseman/[email protected] as suspicious (high confidence) because it claims the release "ships Python bytecode". The published artifact and the downloaded scan bundle provide no evidence of any Python bytecode, and ClawHub's deterministic static analyzer reports clean / zero findings.

This appears to be a ClawScan semantic false positive.

Package / release

• Package: @liseman/openclaw-louter
• Version: 0.2.8
• ClawHub release ID: rd78vzb9d2dp2dzv9nrg7e3z998em5m2
• Source repo: https://github.com/liseman/openclaw-louter
• Source commit: 51b6fe8afebc967e49c9084950d7f5bd2e722fc6
• Published artifact SHA-256 reported by the scan manifest: 610cd7cd381874388da6808ce689afe6a0fb6e94d9472871f58b6e67979eef3a
• Scan manifest file count: 22

Conflicting scanner results

static-analysis.json:

{
  "engineVersion": "v2.4.26",
  "findings": [],
  "reasonCodes": [],
  "status": "clean",
  "summary": "No suspicious patterns detected."
}

clawscan.json:

{
  "confidence": "high",
  "status": "suspicious",
  "summary": "Louter's router behavior is mostly disclosed and purpose-aligned, but the release needs review because it ships Python bytecode in its install scripts despite saying generated bytecode is excluded.",
  "verdict": "suspicious"
}

Evidence that the artifact does not ship Python bytecode

The ClawHub scan report ZIP was downloaded with:

clawhub scan download @liseman/openclaw-louter --version 0.2.8 --kind plugin --output louter-0.2.8-scan.zip

Searching the extracted scan bundle for .pyc, .pyo, __pycache__, or "bytecode" finds only the text of ClawScan's own assertion in clawscan.json. There is no bytecode file/evidence in the manifest or deterministic findings.

The release CI also builds the actual npm tarball and fails if it contains any of:

• __pycache__
• *.pyc
• *.pyo
• *.bak
• *.pre-*

The package additionally has a deterministic prepack cleanup step. This was added because an earlier intermediate CI run genuinely caught generated .pyc files; after the cleanup fix, both the branch and final merged CI passed the artifact audit. In other words, the release gate demonstrably detects the condition ClawScan claims is present.

Prior 0.2.7 false positive

0.2.7 had a separate deterministic static-analysis false positive:

suspicious.install_untrusted_source on config.example.json because the local inference endpoint was spelled http://127.0.0.1:18080/.... That was changed to localhost in 0.2.8 while preserving runtime loopback-only validation. The 0.2.8 deterministic static analyzer is now fully clean.

Request

Please:

1. Review/rescan @liseman/[email protected] and clear the suspicious flag if appropriate.
2. Investigate why ClawScan inferred that Python bytecode exists when the published artifact/scan evidence does not contain it.
3. Ideally require file-level evidence before ClawScan makes concrete claims that an artifact "ships" a particular file type.

The package is a community OpenClaw model router; its routing/config behavior is documented and purpose-aligned. The disputed ClawScan verdict is specifically the unsupported bytecode claim.