Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- lib/oauth.js:22
- Evidence
export function readCredentials(env = process.env) {
Security audit
TinkerClaw Grok Bridge
Security checks for vulnerabilities and agentic risk
Overview
This plugin transparently bridges a user-approved SuperGrok OAuth login into OpenClaw, with credential storage and config changes that match its stated purpose.
Install only if you are comfortable granting OpenClaw a persistent Grok OAuth token and allowing this plugin to modify the xai provider configuration. Use the logout command to remove the stored token, and separately remove the auth profile if you want all traces cleared.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access