Back to plugin

Security audit

Turboquant

Security checks for vulnerabilities and agentic risk

Overview

The plugin's code, instructions, and metadata are internally consistent: it implements an on‑gateway extractive compression hook that matches the declared purpose and asks for no credentials or risky installs.

This plugin appears to do what it claims: compress old conversation turns before each LLM call and it requires no credentials or external downloads. Before enabling broadly: (1) test on non-sensitive conversations to confirm quality (extractive compression can drop context that some prompts need), (2) back up your openclaw.json and verify plugin API compatibility with your gateway version, and (3) monitor logs for unexpected behavior. If you rely on complete context for safety/verification/legal reasons, avoid compressing those conversations or raise minTurnsBeforeCompression/keepRecentTurns accordingly.

Static analysis

No suspicious patterns detected.