Security audit
MAX Messenger
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent MAX Messenger channel plugin with disclosed messaging, media, webhook, and polling behavior.
Before installing, understand that this plugin will connect your OpenClaw agent to MAX Messenger, process incoming chat/media content, and let the agent send messages, media, and some message-management actions through your bot token. Configure DM/group allowlists, webhook secrets, and media roots carefully, especially for group chats where the documented default can be permissive.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.