Security audit
OpenClaw Arcee AI Provider
Security checks for vulnerabilities and agentic risk
Overview
ClawScan rates the arcee plugin benign: the completed scanner reported no findings, and all five reviewed dimensions are marked ok.
The available scan completed and reported no findings, supporting the benign verdict. Benign does not mean risk-free, and the results do not describe the plugin's behavior in detail; consider whether it fits your needs and review its details before installing.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
SkillSpector was not run because this plugin release contains no bundled skills.
Endor dependency reachability
Checked Nov 8, 2026 · 9:08 PM UTC
No reachable vulnerabilities reported
Endor dependency scan completed.