Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/native/cli.js:152
- Evidence
const child = spawn(command, args, {
Security audit
reverseclaw
Security checks across malware telemetry and agentic risk
Overview
This appears to be a legitimate OpenClaw checkpoint/rollback plugin, but it has some naming and packaging inconsistencies and should be treated as executable plugin code, not a purely instructional skill.
Install this only if you want a plugin that can read and write OpenClaw session/workspace state, create checkpoints, and potentially restore workspace files. Review the naming mismatch between reverseclaw, clawreverse, and ClawReverse so you know which plugin entry is actually being enabled. Be cautious with --restore-workspace because it changes files on disk, and with --clone-auth because it may copy authentication context to a child agent. Confidence is medium because some bundled source files were omitted/truncated in the provided review payload.
VirusTotal
VirusTotal engine telemetry is currently stale for this artifact.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/native/cli.js:42
- Evidence
let password = [REDACTED](