Security audit
Zulip
Security checks for vulnerabilities and agentic risk
Overview
This Zulip channel plugin has sensitive chat, credential, upload, and message-action capabilities, but they are disclosed, scoped, and consistent with its OpenClaw integration purpose.
Install only for a Zulip bot account you intend OpenClaw to operate. Review allowFrom, groupAllowFrom, streams/topics, actionTiers, approval approvers, and media.localRoots before enabling; avoid broad local roots such as / and keep moderation or streamAdmin off unless the bot should edit/delete messages or manage streams.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.