Security audit
ClawWorld
Security checks for vulnerabilities and agentic risk
Overview
Review recommended: the plugin posts activity data and also keeps a persistent ClawWorld chat connection that can send remote messages into your agent, which is not clear from the main description.
Before installing, confirm you want both activity/status posting and a persistent ClawWorld chat channel. Pair it only with a trusted ClawWorld account, protect ~/.openclaw/clawworld/config.json, and look for controls to disable or restrict inbound messages if you only want reporting.
Static analysis
No suspicious patterns detected.
