File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docs/rcs.md:54
- Evidence
authToken: "[REDACTED]",
Security audit
OpenClaw RCS
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Twilio RCS channel plugin whose credential use, webhook handling, network calls, and local persistence match its stated messaging purpose.
Install only if you intend OpenClaw to send and receive RCS messages through your Twilio account. Keep the Twilio auth token in a secret reference or environment variable, use the default pairing or an allowlist unless you truly want open inbound messaging, and do not expose a webhook with signature validation disabled except for local testing.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal