Policy Engine

• Risk level: Low
• Analyzed: Feb 17, 2026, 8:24 PM
• Findings: 0
• Version: 1.1.0

Overview

The plugin's code, docs, and runtime instructions align with a policy/governance purpose and its requirements are proportionate; main risks are operational (break-glass env var, hot-reload via gateway, and source provenance) rather than being covert or incoherent.

This plugin appears coherent for enforcing tool policies, but check provenance before installing: the registry metadata shows 'source: unknown' and the README suggests cloning a GitHub repo — confirm the official upstream and verify the code (or run in an isolated test environment). Use dry-run first to observe what would be blocked. Protect the break-glass env var (OPENCLAW_POLICY_BYPASS) and gateway/config endpoints; anyone who can set that variable or patch gateway config effectively disables the policy. If you will deploy broadly, perform a code review and test hot-reload behavior to ensure it can't be abused by users who already have gateway privileges.