Security audit
Security checks across malware telemetry and agentic risk
The skill has a real account-rotation purpose, but it exposes powerful account and session controls through an unauthenticated network dashboard and handles credentials in risky ways.
Install only if you intentionally want this skill to manage Antigravity account rotation and live session switching. Do not expose port 18090 to a LAN or the internet; bind it to localhost or add authentication first. Back up OpenClaw auth profiles, review the cron entry before enabling it, use dedicated low-risk accounts where possible, and treat config.json plus auth profile files as sensitive secrets.
refresh_token: refreshToken,
grant_type: 'refresh_token'
}).toString();
const cmd = `curl -s --connect-timeout 10 --retry 1 -X POST "${this.REFRESH_TOKEN_URL}" -d "${postData}"`;
try {
const output = execSync(cmd, { encoding: 'utf8', timeout: 35000 });
const json = JSON.parse(output);66/66 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal