Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:43
- Evidence
const groqKey = process.env.GROQ_API_KEY;
Security audit
MAX Messenger
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed MAX Messenger channel plugin, with privacy-sensitive media processing that users should configure knowingly.
Install only if you are comfortable giving this plugin access to MAX messages and attachments. Configure allowlists carefully, notify users that voice, image, and PDF content may be processed by OpenClaw and third-party model providers, and avoid enabling GROQ_API_KEY or multimodal models unless that processing is intended.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access