Maverick MCPorter
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The plugin's code and runtime instructions match its stated purpose: it registers two admin-scoped RPCs and manages a small JSON config at $HOME/.mcporter/mcporter.json without unexpected network calls or unrelated credential requirements.
This plugin appears to do exactly what it says: register two admin-scoped RPCs and manage $HOME/.mcporter/mcporter.json. Before installing, ensure you only grant operator.admin to trusted operators because the RPC can add Authorization headers (i.e., API tokens) into the persisted config. Note that the README/example uses a literal "$env:..." placeholder — the plugin does not expand environment variables and will store that text as-is. Restart the OpenClaw gateway after installation as instructed. If you want to avoid storing secrets in a file, restrict use of the RPC and audit stored config files regularly.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings