Security audit

Apify

Security checks across malware telemetry and agentic risk

Overview

The package is a coherent Apify web-scraping plugin that uses an Apify API key for user-directed scraping, with some setup caveats but no artifact-backed malicious behavior.

Install only if you want agents to run Apify Actors on your behalf. Treat the Apify API key as sensitive, monitor Apify usage and costs, avoid custom base URLs, and review Actor inputs before starting broad social, lead-generation, or contact-info scraping jobs.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/bump-openclaw.mjs:52
Evidence: const result = spawnSync(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-version.mjs:48
Evidence: const result = spawnSync(cmd, args, {