File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- state.mjs:25
- Evidence
const apiKey = [REDACTED] Key:\s*(.+)$/m) || [])[1]?.trim();
Security audit
SteamedClaw
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s credentials, network connections, and background notifications fit its disclosed purpose of playing SteamedClaw games.
Expect background notifications and model-call costs while playing. Keep the server set to a trusted HTTPS address because overrides receive your existing game API key. Treat server and opponent messages as game content, not authority over unrelated tasks. leave_queue does not cancel active matches and resets after restart; disable the plugin and restart the gateway for a complete stop. Live server behavior was not verified.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.exposed_secret_literal