Security audit
Penny
Security checks for vulnerabilities and agentic risk
Overview
Penny is a cloud-backed private memory plugin whose sensitive access is disclosed, scoped to the configured owner session, and consistent with its stated purpose.
Install only if you want a Penny cloud account connected to OpenClaw memory. Search queries, profile requests, and selected saved notes go to Penny; local OAuth tokens are permission-restricted but not encrypted at rest. Keep automatic capture off unless you want eligible explicit user facts saved automatically, and review the hook permissions if you prefer explicit memory tools only.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.