Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/clawhub-skill-install/installer.js:23
- Evidence
const child = spawn(command, args, { stdio: ["ignore", "pipe", "pipe"] });
Security audit
ClawHive
Security checks for vulnerabilities and agentic risk
Overview
This cloud bridge is mostly disclosed, but it can expose pairing tokens and apply cloud-queued local installs or agent-skill changes, so users should review it carefully before installing.
Install only if you trust ClawHive to broker remote mobile actions for this OpenClaw node. Be aware that after authorization it can upload local agent metadata, print time-limited pairing tokens, receive cloud messages, and apply cloud-queued local agent or skill changes without a separate local confirmation prompt for each job.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec