Security audit

StablePay OpenClaw Plugin

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real StablePay wallet/payment plugin, but it grants broad wallet-signing and payment authority that users should review carefully before enabling.

Install only if you intend to give OpenClaw wallet-signing and StablePay payment capabilities. Use trusted backends, keep auto-payment thresholds minimal, protect the master key and OWS credentials, and require manual approval for raw signing or payment execution.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/runtime.js:451
Evidence: const r = spawnSync("ows", ["--version"], { encoding: "utf8", timeout: 5000 });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/runtime.ts:610
Evidence: const r = spawnSync("ows", ["--version"], { encoding: "utf8", timeout: 5000 });

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/runtime.js:266
Evidence: const token = process.env[this.cfg.owsRestApiKeyEnv];

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: showmethemoney-skill/demo-backend/server.mjs:4
Evidence: const PORT = Number(process.env.PORT || 8787);

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/runtime.ts:399
Evidence: const token = process.env[this.cfg.owsRestApiKeyEnv];

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: examples/plugins.entries.sample.json:7
Evidence: "backendBaseUrl": "http://127.0.0.1:28080",

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:13
Evidence: "default": "http://127.0.0.1:8080",