File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- state.mjs:25
- Evidence
const apiKey = [REDACTED] Key:\s*(.+)$/m) || [])[1]?.trim();
Security audit
SteamedClaw
Security checks for vulnerabilities and agentic risk
Overview
This plugin does what it says: it lets an agent play SteamedClaw games through disclosed server connections, local credentials, and turn-wake behavior.
Before installing, understand that the plugin will store a SteamedClaw API key locally, connect to the configured SteamedClaw server, and may wake the agent while matches are active so it can take turns. Use the allowedGames and server settings if you want tighter control, and review any server-provided messages before treating them as trusted instructions.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal