Security audit
MAX Messenger
Security checks across malware telemetry and agentic risk
Overview
This MAX Messenger plugin is mostly coherent, but it automatically expands TLS trust for the entire OpenClaw Node.js process, which is broader than the channel itself needs.
Install only if you are comfortable with this plugin adding the Russian Trusted Root/Sub CA bundle to the entire OpenClaw Node.js process. Prefer running it in a dedicated gateway or container, set a webhookSecret if using webhooks, and review whether your deployment makes other sensitive outbound TLS calls from the same process.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
59/59 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.