Security audit
OpenClaw Photon
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed OpenClaw iMessage channel plugin with scoped Photon credentials, allowlisted messaging, and bounded local journaling.
Install only if you intend OpenClaw to send and receive allowlisted iMessage DMs through Photon. Treat the Photon project secret and local OpenClaw files as sensitive, review the allowlists before enabling, and note the README's beta warning about provider availability and manual review of quarantined delivery states.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.