Back to plugin

Security audit

Freedom Preserving Protocol — Enforcement

Security checks across malware telemetry and agentic risk

Overview

The plugin’s behavior is mostly disclosed and purpose-aligned, but it should be reviewed because it is a startup dispatcher hook that still allows installation on known vulnerable OpenClaw versions.

Review before installing. Use only with a patched OpenClaw runtime newer than the affected advisory ranges, and expect the plugin to inspect and gate tool calls while writing local audit, receipt, mandate, and identity files. Avoid dangerous overrides such as fail-open approval timeouts or removing default hard blocks unless you intentionally accept that risk.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
node_modules/@ovrsr/fpp-protocol-core/dist/steward-authorization.d.ts:13
Evidence
readonly authorization: "[REDACTED]";

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
node_modules/@ovrsr/fpp-protocol-core/dist/steward-authorization.js:30
Evidence
authorization: "[REDACTED]",

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
node_modules/@ovrsr/fpp-protocol-core/src/steward-authorization.ts:36
Evidence
authorization: "[REDACTED]",