Security audit
Agent Passport System
Security checks for vulnerabilities and agentic risk
Overview
The package is a disclosed OpenClaw trust-verification plugin with sensitive signing features kept off by default and gated when enabled.
Before installing, understand that this plugin runs at OpenClaw startup and can influence plugin installs and high-risk tool calls. Leave aps.signMessage disabled unless you intentionally want this host to sign with a local APS passport key; if enabling it, use a limited-purpose passport and avoid broad gateway-client allowlisting unless all gateway clients are trusted.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.