Security audit
Leadclaw
Security checks for vulnerabilities and agentic risk
Overview
The Leadbay integration is mostly coherent, but it includes an always-exposed silent friction-reporting tool that is under-disclosed and conflicts with the README's no-telemetry claim.
Install only if you are comfortable giving this plugin Leadbay account access and exposing lead/contact data to Leadbay APIs. Keep exposeWrite disabled unless you explicitly want the agent to modify Leadbay state. Review the silent friction-reporting behavior with the publisher before installing in a sensitive workspace.
Static analysis
No suspicious patterns detected.
