Back to plugin

Security audit

OpenClaw Kitchen Sink

Security checks for vulnerabilities and agentic risk

Overview

This looks like a broad OpenClaw test plugin, but its sensitive-looking surfaces are disclosed, local, and deterministic rather than hidden or destructive.

This is appropriate for OpenClaw plugin development, CI, conformance, or API-surface testing. Because it intentionally registers many hooks and provider/channel surfaces, users should keep it disabled outside test contexts or use its conformance mode when they want only clean valid runtime surfaces. I found no artifact evidence of hidden exfiltration, destructive actions, real credential use, or external network activity.

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
src/fixtures/text.js:16
Evidence
apiKey: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
src/runtime/providers.js:336
Evidence
apiKey: "[REDACTED]",