Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/index.js:1563
- Evidence
const output = execSync(hook.script, {
Security audit
TinkerClaw Prefrontal
Security checks for vulnerabilities and agentic risk
Overview
This plugin is purpose-related orchestration software, but it exposes broad control paths that deserve manual review before installation.
Install only if you want this package to act as a high-authority orchestration layer for OpenClaw. Review who can call its gateway methods, avoid enabling untrusted recipe/script inputs, keep JourneyKits API keys scoped, and treat configured permission-hook scripts as local command execution with your user privileges.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec