Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- index.ts:43
Security audit
Dingtalk
Security checks across malware telemetry and agentic risk
Overview
The DingTalk integration mostly matches its stated messaging purpose, but its inbound webhook handling appears to accept messages without visible DingTalk signature/origin or allowlist enforcement.
Review this plugin before installing. It appears to be a normal DingTalk messaging channel, but only use it if your OpenClaw Gateway or the plugin verifies DingTalk callback authenticity and enforces user/group allowlists. Configure a least-privilege DingTalk app or robot, avoid broad permissions, and confirm the source/version mismatch is acceptable for your environment.
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index.ts:44
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- onboarding.ts:225
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- probe.ts:32