Security audit
W&B Weave
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed W&B observability plugin that sends agent traces, including unredacted conversation and tool content by default, but that behavior matches its stated purpose and has documented controls.
Install only if you want OpenClaw telemetry sent to W&B Weave. For sensitive work, set captureContent=false or scrub prompts, replies, and tool data upstream, use a scoped W&B API key or SecretRef instead of a literal key, and confirm project access and retention settings in W&B.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.