Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/src/monitor.js:97
- Evidence
const value = Number(process.env[name]);
Security audit
Security checks across malware telemetry and agentic risk
Overview
This is a coherent Facebook Messenger channel plugin that uses expected Meta credentials and network calls for webhook handling and replies, with the optional external Leaderbot bridge disclosed and disabled by default.
Install only if you intend to connect an OpenClaw assistant to a Facebook Page. Treat the Page access token, app secret, and verify token as sensitive; prefer pairing or allowlist for private pages. Before using open public DMs, publish privacy/data-retention terms and restrict host tools for untrusted users. Leave the Leaderbot bridge disabled unless you intentionally want Messenger payloads, sender IDs, prompts, and media URLs sent to that separate service.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access