Security audit

Apify

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Apify integration that exposes a broad, user-authorized web-scraping tool and setup CLI, with no artifact-backed malicious behavior found.

Install only if you intend to give OpenClaw access to an Apify token and authorize agents to run Apify Actors, which may incur Apify usage costs and collect third-party web data. Prefer scoping tool authorization to apify rather than group:plugins if you do not want all plugin tools enabled, keep the baseUrl at the official Apify API, and treat scraped results and Actor documentation as untrusted external content.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/bump-openclaw.mjs:57
Evidence: const result = spawnSync(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-version.mjs:48
Evidence: const result = spawnSync(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-clawhub.mjs:98
Evidence: const result = spawnSync("clawhub", args, { stdio: "inherit", shell: false, cwd: REPO_ROOT });