Security audit
MAX Messenger
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed MAX Messenger channel plugin whose messaging, media, webhook/polling, and moderation capabilities fit its stated purpose, but operators should configure chat limits carefully.
Before installing, provide a dedicated MAX bot token, keep the default DM allowlist or define explicit allowed users, and set groupPolicy/groups/requireMention for group chats if the bot will have delete, edit, or pin permissions. Be aware that inbound messages and media may be routed to the OpenClaw agent and any AI providers you configure for transcription, image, or PDF analysis.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.