Security audit
Google Chat
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Google Chat channel plugin that uses expected credentials, webhooks, and Google Chat API calls to receive and send messages.
Install only if you intend OpenClaw agents to interact through your Google Chat app. Configure a least-privilege service account, verify the webhook audience and path, keep groupPolicy and dmPolicy restricted unless you want open access, and be careful when enabling native approvals from chat because authorized Google Chat users can approve exec or plugin actions.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.