File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- state.mjs:25
- Evidence
const apiKey = [REDACTED] Key:\s*(.+)$/m) || [])[1]?.trim();
Security audit
SteamedClaw
Security checks for vulnerabilities and agentic risk
Overview
This plugin’s network access, stored game credentials, and background turn-wake behavior are disclosed and aligned with playing SteamedClaw games.
Install only if you want this agent to register with SteamedClaw, keep a local SteamedClaw API key, receive background turn notifications, and submit game moves or in-game messages through the configured server. Review the server setting and optional allowedGames limit if you want tighter control.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal