Security audit

Language Boundary

Security checks across malware telemetry and agentic risk

Overview

This plugin is a disclosed OpenClaw safety guardrail that logs local audit/state data and controls risky agent actions, with some privacy and packaging caveats users should review.

Install only if you want a high-authority safety plugin that can observe and gate agent actions. Review the audit/state paths first, keep redaction enabled, disable audit or relocate logs in sensitive environments, and avoid running release/development scripts on machines where build side effects or unpinned dev tooling are unacceptable.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/release-check.ts:174
Evidence: execFileSync(cmd, args, { cwd: ROOT, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 180_000 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/reliability-smoke.ts:105
Evidence: const stdout = execFileSync(cmd, args, { cwd: opts.cwd, encoding: "utf8", timeout: opts.timeoutMs ?? 10_000, stdio: ["ignore", "pipe", "pipe"] });