File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/auth.js:153
- Evidence
access_token: [REDACTED],
Security audit
TangleClaw eBay Seller
Security checks across malware telemetry and agentic risk
Overview
This plugin clearly gives OpenClaw controlled access to the user's own eBay seller account, including sensitive order data and seller actions, with live-listing changes gated by default.
Install only if you intend to let OpenClaw operate your eBay seller account. Keep autoApprove off unless you deliberately want unattended live-listing actions, protect the local credentials and token files, and remember that order reads may show buyer personal information while soft writes execute immediately.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.exposed_secret_literal