HTTPS certificate verification is disabled.
Warn
- Code
- suspicious.insecure_tls_verification
- Location
- dist/postgres.js:17
- Evidence
return { rejectUnauthorized: false };
Security audit
AnchorClaw
Security checks across malware telemetry and agentic risk
Overview
AnchorClaw is a disclosed PostgreSQL-backed memory plugin, but users should install it only with a patched OpenClaw host and understand that setup can enable persistent memory, prompt injection, and background maintenance.
Before installing, use OpenClaw 2026.6.5 or newer, use a dedicated PostgreSQL database/schema, review what anchorclaw setup will write to openclaw.json, and enable sessions search, semantic retrieval, and non-dry-run maintenance only for workspaces whose memory/transcripts you intend to persist and process.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.insecure_tls_verification