File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- src/monitor.lifecycle.test.ts:372
- Evidence
{ headers: { authorization: "[REDACTED]" } } as Request,
Security audit
OpenClaw Microsoft Teams
Security checks across malware telemetry and agentic risk
Overview
This is a coherent Microsoft Teams China channel plugin that can operate on Teams messages, files, users, and groups using the credentials and policies the user configures.
Install only if you intend to let OpenClaw interact with Microsoft Teams China. Configure the Azure app and Graph permissions narrowly, keep dmPolicy/groupPolicy and sender/tool allowlists restrictive, and understand that enabled agents may post, edit, delete, read/search Teams content, manage participants, and upload/share files within the permissions you grant.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.exposed_secret_literal