Security audit
Z.AI OpenClaw provider
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Z.AI provider plugin that uses API keys and provider network calls as expected, with a note that it can read a legacy local token for usage checks.
Install this if you intend to use Z.AI models or media generation through OpenClaw. Be aware that your prompts, media inputs, generated-video requests, and Z.AI API key are used for provider calls, and the plugin may reuse a legacy local Z.AI/Pi Agent token for usage checks if present.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.