Security audit

Apify

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Apify integration that exposes a broad, user-authorized web-scraping tool and setup CLI, with no artifact-backed malicious behavior found.

Install only if you intend to give OpenClaw access to an Apify token and authorize agents to run Apify Actors, which may incur Apify usage costs and collect third-party web data. Prefer scoping tool authorization to apify rather than group:plugins if you do not want all plugin tools enabled, keep the baseUrl at the official Apify API, and treat scraped results and Actor documentation as untrusted external content.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/bump-openclaw.mjs:57
Evidence: const result = spawnSync(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-version.mjs:48
Evidence: const result = spawnSync(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/publish-clawhub.mjs:98
Evidence: const result = spawnSync("clawhub", args, { stdio: "inherit", shell: false, cwd: REPO_ROOT });