Security audit

Session Label from Sender

Security checks for vulnerabilities and agentic risk

Overview

This plugin is a disclosed session-admin tool that locally indexes OpenClaw conversations for search and viewing, with no evidence of exfiltration or deceptive behavior.

Install only if you are comfortable with this plugin creating a searchable local database of OpenClaw conversation history, including tool calls and thinking traces, visible to users who can access the authenticated OpenClaw control UI.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/index.mjs:1440
Evidence: var P = /[!-#%-\*,-\/:;\?@\[-\]_\{\}\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060...

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: dist/md-client.js:379
Evidence: var P = /[!-#%-\*,-\/:;\?@\[-\]_\{\}\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060...

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: index.mjs:1440
Evidence: var P = /[!-#%-\*,-\/:;\?@\[-\]_\{\}\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060...

Potential obfuscated payload detected.

Warn

Code: suspicious.obfuscated_code
Location: md-client.js:379
Evidence: var P = /[!-#%-\*,-\/:;\?@\[-\]_\{\}\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060...