Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/store/calendar-sync.ts:19
- Evidence
* old `exec(\`gog … --from ${from}\`)` a caller passing a value containing backticks or $(…) got
Security audit
Tinker Task Panel
Security checks for vulnerabilities and agentic risk
Overview
This is a local task-panel plugin that stores task and calendar data in a disclosed SQLite database, with no evidence of hidden exfiltration or destructive install behavior.
Before installing, confirm you want this plugin to use the existing OpenClaw control-panel database and to expose write-capable task-management RPCs. Calendar refresh depends on the local `gog` tool and its configured Google Calendar access; no hidden network or credential harvesting behavior was found in the artifact.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec