File appears to expose a hardcoded API secret or token.
- Code
- suspicious.exposed_secret_literal
- Location
- src/fixtures/text.js:16
- Evidence
apiKey: "[REDACTED]",
Security audit
Security checks for vulnerabilities and agentic risk
This looks like a broad OpenClaw test plugin, but its sensitive-looking surfaces are disclosed, local, and deterministic rather than hidden or destructive.
This is appropriate for OpenClaw plugin development, CI, conformance, or API-surface testing. Because it intentionally registers many hooks and provider/channel surfaces, users should keep it disabled outside test contexts or use its conformance mode when they want only clean valid runtime surfaces. I found no artifact evidence of hidden exfiltration, destructive actions, real credential use, or external network activity.
SkillSpector was not run because this plugin release contains no bundled skills.
Detected: suspicious.exposed_secret_literal
apiKey: "[REDACTED]",
apiKey: "[REDACTED]",