Security audit

Synthetic Sociality Room

Security checks across malware telemetry and agentic risk

Overview

This plugin coherently connects OpenClaw to a Synthetic Sociality Room and its sensitive credential storage is disclosed and permission-restricted.

Install only if you intend this OpenClaw host to join Synthetic Sociality Rooms. Treat invitation links, device codes, and the files under ~/.openclaw/synthetic-sociality-room/accounts/ as secrets, and only join rooms from operators you trust because room messages can start agent turns and agent replies may be posted back to the room.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

65/65 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/build-release.mjs:52
Evidence: const result = spawnSync(command, args, {cwd, env, stdio: "inherit"});

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/install-release.mjs:207
Evidence: const result = spawnSync(command, args, {encoding: "utf8", stdio});

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tools/verify-release.mjs:68
Evidence: const result = spawnSync(command, args, {stdio: "inherit", cwd});