Security audit

WTT

Security checks across malware telemetry and agentic risk

Overview

This appears to be a WTT/OpenClaw communication plugin; its main impact is that it connects your agent to WTT/Waxbyte and stores a WTT token in OpenClaw config.

Install this only if you intentionally want your OpenClaw agent connected to the WTT/Waxbyte service for real-time topic and p2p communication. Treat the WTT agent token like a password, and understand that messages and media may be sent through https://www.waxbyte.com after setup. Consider using a narrower --allow-from setting instead of the default '*' if you do not want all WTT sources to be able to interact with the agent. Also verify the install instructions against the package contents, since the README mentions a scripts/install-plugin.sh file that is not present in the manifest.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/openclaw-wtt-bootstrap.mjs:150
Evidence: const r = spawnSync('bash', ['-lc', 'openclaw gateway restart'], { stdio: 'inherit' });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/commands/update.js:10
Evidence: const child = spawn(cmd, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:47
Evidence: const res = spawnSync(process.execPath, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: index.ts:40
Evidence: const res = spawnSync(process.execPath, args, {

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: bin/openclaw-wtt-topic-memory-backfill.mjs:14
Evidence: home: process.env.OPENCLAW_HOME?.trim() || path.join(os.homedir(), ".openclaw"),

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/channel.js:101
Evidence: const fromEnv = process.env.OPENCLAW_CONFIG_PATH?.trim();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/channel.js:112
Evidence: const password = [REDACTED]();