Security audit

K米 OpenClaw 插件

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real K米 integration, but it can act on customer/business data and persist login/session tokens, so it should be reviewed carefully before use.

Use this only if you trust the K米 publisher and understand which K米 account/business permissions it will use. Require explicit confirmation for order, coupon, recharge, or other mutating operations, and review where local session files are stored and how to clear them.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/src/cli.js:8
Evidence: const process = spawn('clawhub', args);

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/cli.ts:10
Evidence: const process = spawn('clawhub', args);