Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/cli.js:8
- Evidence
const process = spawn('clawhub', args);
Security audit
K米 OpenClaw 插件
Security checks across malware telemetry and agentic risk
Overview
This appears to be a real K米 integration, but it can act on customer/business data and persist login/session tokens, so it should be reviewed carefully before use.
Use this only if you trust the K米 publisher and understand which K米 account/business permissions it will use. Require explicit confirmation for order, coupon, recharge, or other mutating operations, and review where local session files are stored and how to clear them.
VirusTotal
VirusTotal engine telemetry is currently stale for this artifact.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/cli.ts:10
- Evidence
const process = spawn('clawhub', args);