Security audit

IdentyClaw Tools

Security checks for vulnerabilities and agentic risk

Overview

The package is a disclosed IdentyClaw/OpenClaw identity and NEAR wallet integration, but it should only be installed when you intend to grant those credential and wallet capabilities.

Install only for agents that should use IdentyClaw Passport credentials and, if enabled, perform NEAR/RODiT wallet operations. Keep idcp and identyclaw_request off unless needed, review apiEndpoint targets, and require explicit operator approval before funding, transferring, rotating, or activating accounts.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:706
Evidence: const child = spawn("bash", [scriptPath, ...args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/postinstall-generate-near-account.mjs:48
Evidence: const result = spawnSync(process.execPath, [script, defaultDir], {

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:68
Evidence: if (process.env[envName] !== undefined) {