Security audit

Package

Security checks for vulnerabilities and agentic risk

Overview

The plugin mostly matches its Q-Claw/WMS/ERP purpose, but it ships a client secret, stores auth tokens locally, and sends token-bearing requests to a default HTTP backend.

Install only if you trust the Q-Claw backend and deployment environment. Before use, replace the packaged client secret, require HTTPS for the backend URL, understand that WMS/ERP queries and context are sent to that backend, and review where the plugin stores local authorization tokens.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.potential_exfiltration

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:1046
Evidence: accessToken = [REDACTED];

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: index.js:216
Evidence: const raw = fs.readFileSync(AUTH_STATE_FILE, "utf-8");