earlyaidopters/claudeclaw: source audit, 2026-10-10
Read from the source at commit 545a6d12c43f; the bot was not run (it needs a BotFather token). Each answer cites the file and line that shows it. All 20 bots
In short
Set ALLOWED_CHAT_ID before connecting anything: until you do, strangers cannot reach Claude, but anyone who finds the bot can use /slack, /wa, /dashboard, /memory and /forget. Once configured, Claude runs with all permissions bypassed and no way to turn that off.
What the source shows
| Answer | Where | |
|---|---|---|
| Who can use it | Until you set your chat ID, some commands answer anyone | src/bot.ts:304-309 — if (!ALLOWED_CHAT_ID) { // Not yet configured — let every request through ... return true; } |
| With no allowlist set | env ALLOWED_CHAT_ID, default empty; the Claude agent is not reachable until it is set, but several side commands are served to anyone | src/bot.ts:350-354 — agent path replies with your chat ID and returns; /slack and /wa gate only on isAuthorised, which is true when unset |
| Before the agent acts | runs the agent with permission prompts switched off | src/agent.ts:224-225 — permissionMode: 'bypassPermissions', allowDangerouslySkipPermissions: true (hardcoded) |
| Bot token | Read from the environment or a config file; no real token is committed | |