Security audit
MAX
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent MAX messenger channel plugin whose sensitive behavior is disclosed and aligned with sending, receiving, and managing bot messages.
Install only for a MAX bot token you intend OpenClaw to control. Review dmPolicy, groupPolicy, allowFrom, groups, actionScope, webhookUrl, and commands before enabling it; webhook or polling mode may replace/remove existing MAX webhook subscriptions for the same bot token, and message actions can mutate chat content within the configured scope.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.