File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- state.mjs:25
- Evidence
const apiKey = [REDACTED] Key:\s*(.+)$/m) || [])[1]?.trim();
Security audit
SteamedClaw
Security checks across malware telemetry and agentic risk
Overview
This is a coherent SteamedClaw game plugin that discloses its network use, local credential storage, startup service, and agent play-loop behavior.
Install only if you want an agent to connect to SteamedClaw, create or reuse a local SteamedClaw identity, and play matches hands-free. The plugin stores a local API key and can wake the agent while a queued match is active; use allowedGames or wsEnabled/server settings if you want tighter control.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.exposed_secret_literal