Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/adapters/gateway-rpc.js:109
- Evidence
const child = spawn(argv[0], argv.slice(1), {
Security audit
Wave Runner
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed, operator-controlled backlog runner that can launch coding agents and write worktree state, with bounded safety gates rather than hidden or unbounded behavior.
Install only if you want an OpenClaw plugin that can orchestrate coding agents against selected repository tickets. Review the tickets and verification commands before running supervised waves, keep Gateway credentials scoped, and remember that isolated worktrees reduce risk but are not a full operating-system sandbox for child agents.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
53/53 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/adapters/grok-cli.js:7
- Evidence
const child = spawn(input.command, input.args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/adapters/workspace.js:36
- Evidence
output = execFileSync("bash", ["-lc", input.command], {