Security audit

UnraidClaw

Security checks for vulnerabilities and agentic risk

Overview

This plugin gives an AI agent disclosed administrative controls over a configured Unraid server, which is high-impact but coherent with its stated purpose.

Install only if you want OpenClaw agents to administer your Unraid server. Use a least-privilege UnraidClaw API key, keep the gateway permission matrix restrictive, avoid tlsSkipVerify unless you understand the tradeoff, and require explicit confirmation for shutdown, reboot, plugin install/remove, container removal, and VM force-stop actions.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.install_untrusted_source

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/index.js:24
Evidence: this.insecureAgent = new HttpsAgent({ rejectUnauthorized: false });

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:182
Evidence: "placeholder": "https://192.168.1.100:9876"