Security audit

EvalDossier for OpenClaw

Security checks across malware telemetry and agentic risk

Overview

This plugin coherently provides a local, bounded verifier for EvalDossier files and does not show hidden network, credential, persistence, or destructive behavior.

Install this if you want an offline verifier for EvalDossier files. It will read caller-specified request and dossier contents from the active workspace and run local cryptographic/schema checks; it does not establish external truth or identity beyond the dossier's declared evidence and signatures.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/index.js:146
Evidence: execFile(process.execPath, [

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: runtime/shared/evaldossier-local-core.mjs:2941
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);