Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/cli-core.js:566
- Evidence
const linked = spawnSync(openclawBin, ["plugins", "install", "--link", root], {
Security audit
Agent Knock Knock
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed local bridge that lets OpenClaw send work to already-running Codex or Claude terminal sessions, with powerful but purpose-aligned local controls.
Install only if you want OpenClaw to control existing local Codex or Claude Code terminal panes. Keep autoApprove disabled unless you configure exact trusted commands and workspace roots, and remember that task text and terminal output are still processed by the coding agents and providers you use.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/codex-store-adapter.js:365
- Evidence
const child = spawn("sqlite3", args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/doctor-capabilities.js:33
- Evidence
const result = spawnSync(executable, args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/herdr-terminal-control-provider.js:1040
- Evidence
const result = spawnSync(command, args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/openclaw-doctor.js:175
- Evidence
const result = spawnSync(executable, args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/openclaw-plugin.js:1740
- Evidence
const spawned = spawnSync(process.execPath, [binPath, ...cliArgs], {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/terminal-control-provider.js:865
- Evidence
const result = spawnSync(command, args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/terminal-process-source.js:118
- Evidence
const result = spawnSync(command, args, {