Security audit
ClickClack
Security checks for vulnerabilities and agentic risk
Overview
This package is a disclosed ClickClack channel plugin that uses user-provided bot credentials to relay chat messages and optionally manage discussion channels.
Install only if you intend to connect OpenClaw to a ClickClack workspace. Use a least-privilege bot token, prefer a secret store or environment variable over plain config where practical, restrict allowed senders or require mentions for shared channels, and enable managed discussions only for the account that should create and maintain public discussion channels.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.