Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.mjs:2131
- Evidence
const processEnv = (0, environment_1.parseEnvironment)(process.env);
Security audit
Trovis Agent Management
Security checks for vulnerabilities and agentic risk
Overview
The plugin coherently provides Trovis telemetry, with disclosed data export and opt-in content capture.
Install only if you want OpenClaw telemetry sent to Trovis or another trusted configured endpoint. Review SOUL.md, IDENTITY.md, and AGENTS.md before enabling because those contents are exported on startup; enable captureOutputs or readUserData only if message content, tool results, USER.md, and MEMORY.md may safely leave the machine.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access, suspicious.potential_exfiltration
Sensitive-looking file read is paired with a network send.
Warn
- Code
- suspicious.potential_exfiltration
- Location
- dist/index.mjs:6383
- Evidence
const result = await fs_1.promises.readFile("/etc/hostid", { encoding: "utf8" });