Security audit

IdentyClaw Tools

Security checks across malware telemetry and agentic risk

Overview

The package is a disclosed IdentyClaw/OpenClaw identity and NEAR wallet integration, but it should only be installed when you intend to grant those credential and wallet capabilities.

Install only for agents that should use IdentyClaw Passport credentials and, if enabled, perform NEAR/RODiT wallet operations. Keep idcp and identyclaw_request off unless needed, review apiEndpoint targets, and require explicit operator approval before funding, transferring, rotating, or activating accounts.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:706
Evidence: const child = spawn("bash", [scriptPath, ...args], {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/postinstall-generate-near-account.mjs:48
Evidence: const result = spawnSync(process.execPath, [script, defaultDir], {

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:68
Evidence: if (process.env[envName] !== undefined) {