Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/index.js:983
- Evidence
log.info(`env for claude spawn (${Object.keys(cleanEnv).length} vars, names only): ${envKeys}`);
Security audit
TinkerClaw Tinker Bridge
Security checks across malware telemetry and agentic risk
Overview
This plugin is clearly a Claude Code bridge, but it gives a long-running Claude subprocess broad local machine authority without per-tool confirmation.
Install only if you intentionally want Claude Code to act as an unattended local agent through OpenClaw. Review the default disallowedTools setting before use, because the default permits shell commands and file edits under your user account, and use a dedicated workspace/account if you need containment.
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
62/62 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/index.js:18
- Evidence
var OAUTH_PLACEHOLDER_API_KEY = "[REDACTED]";