Security audit
Security checks for vulnerabilities and agentic risk
This is a simple hello-world OpenClaw plugin that registers one greeting tool and does not access files, network, credentials, memory, or privileged system features.
This plugin is appropriate for testing a hello-world OpenClaw setup. Be aware that it may respond to ordinary greetings by calling its hello tool, and users who need strict reproducible builds may want dependency versions pinned before production use.
The manifest description says to use the skill when the user 'asks for a hello, a greeting, says hi,' which are very common conversational phrases and not narrowly scoped to plugin use. This can cause unintended invocation during ordinary chat because the activation boundary is not clearly limited beyond a general greeting.
The instruction to trigger when the user asks for a greeting, says 'hello' or 'hi' is too broad because those phrases commonly occur in normal conversation. The file does not provide negative examples or constraints distinguishing casual greetings from intentional skill invocation.
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"openclaw": ">=2026.3.24-beta.2"
},
"dependencies": {
"@sinclair/typebox": "^0.32.0"
},
"devDependencies": {
"typescript": "^5.4.0"
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
"@sinclair/typebox": "^0.32.0"
},
"devDependencies": {
"typescript": "^5.4.0"
}
}