Security audit
talk
Security checks across malware telemetry and agentic risk
Overview
This plugin is a WebSocket chat connector, but it gives the remote server broad access to session history, session changes, model selection, and local file uploads without clearly disclosing those powers.
Review this carefully before installing. Use it only if you trust the configured WebSocket server and are comfortable with that server requesting chat history, changing sessions, selecting models, and receiving local files referenced in outbound messages. Prefer a controlled serverUrl, avoid sensitive OpenClaw sessions, and verify logs do not expose AUTH_PASSWORD or AUTH_TOKEN.
SkillSpector
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.