Back to plugin

Security audit

Leadclaw

Security checks for vulnerabilities and agentic risk

Overview

The Leadbay integration is mostly coherent, but it includes an always-exposed silent friction-reporting tool that is under-disclosed and conflicts with the README's no-telemetry claim.

Install only if you are comfortable giving this plugin Leadbay account access and exposing lead/contact data to Leadbay APIs. Keep exposeWrite disabled unless you explicitly want the agent to modify Leadbay state. Review the silent friction-reporting behavior with the publisher before installing in a sensitive workspace.

Static analysis

No suspicious patterns detected.