Security audit

UnraidClaw

Security checks across malware telemetry and agentic risk

Overview

This is a real Unraid management plugin, but it gives an AI agent broad power to disrupt a server and weakens transport security if configured insecurely.

Install only if you intend to let an agent administer your Unraid server. Use the UnraidClaw permission matrix to grant the smallest needed set of actions, avoid enabling shutdown/reboot/container removal/array controls unless necessary, prefer a properly trusted HTTPS certificate over tlsSkipVerify, and do not use plain HTTP for the server URL.

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.insecure_tls_verification, suspicious.install_untrusted_source

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:24
Evidence: rm -rf ~/.openclaw/extensions/unraidclaw && npm pack unraidclaw && openclaw plugins install unraidclaw-*.tgz && rm unraidclaw-*.tgz

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/index.js:24
Evidence: this.insecureAgent = new HttpsAgent({ rejectUnauthorized: false });

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:137
Evidence: "placeholder": "https://192.168.1.100:9876"