Security audit
IdentyClaw Webhooks
Security checks for vulnerabilities and agentic risk
Overview
This package is a disclosed OpenClaw webhook plugin that uses local Passport credentials to verify and send signed webhooks, with no artifact-backed evidence of hidden or unrelated behavior.
Install this only on gateways intended to receive or send IdentyClaw/RODiT webhooks, and review the exposed endpoints, credential file path, peer registry persistence, receipts debug endpoint, and any TLS-skip development setting before enabling it in production.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.