File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/monitor.lifecycle.test.ts:372
- Evidence
{ headers: { authorization: "[REDACTED]" } } as Request,
Security audit
OpenClaw Microsoft Teams
Security checks across malware telemetry and agentic risk
Overview
This Teams plugin mostly matches its stated purpose, but it needs Review because it stores sensitive Microsoft tokens and has several under-scoped high-impact sharing and authorization behaviors.
Review this before installing in a production Teams tenant. Use stable AAD user IDs in allowlists, avoid display-name approvers, disable delegatedAuth, SSO, or feedbackReflection unless needed, restrict Graph permissions and media-local roots, and configure file sharing so uploads do not fall back to organization-wide links. Upgrade the OpenClaw host/dependency minimum to a patched version.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.exposed_secret_literal