Back to plugin
Pluginv0.2.99
ClawScan security
Tombstone · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 10:07 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a harmless deprecation stub that only instructs users to install the renamed plugin; it does not request credentials, install code, or perform unexpected actions.
- Guidance
- This package is a deprecated placeholder that intentionally does nothing besides telling you to install openclaw-murf-tts. It doesn't request credentials or perform installs. Installing this exact package will fail at runtime (its register() throws an error), so install the suggested replacement (openclaw-murf-tts) instead. If you maintain configs that reference this plugin, rename entries as the SKILL.md describes.
Review Dimensions
- Purpose & Capability
- okName, description, SKILL.md, and package files consistently state this is a deprecated/renamed plugin and point users to openclaw-murf-tts. The small included code simply throws an error instructing users to install the replacement — nothing in the package requires unrelated capabilities.
- Instruction Scope
- okSKILL.md only contains deprecation/migration instructions and install commands for the replacement plugin; it does not ask the agent to read unrelated files, environment variables, or send data to external endpoints beyond the suggested npm/ClawHub links.
- Install Mechanism
- okThere is no install spec and no network-download install steps. The package contains a tiny dist/index.mjs which throws an error — no archives or external installers are fetched by this package.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths and the runtime instructions do not reference any secrets or unrelated environment data.
- Persistence & Privilege
- okFlags are default (not always:true). The plugin does not request persistent elevated presence or attempt to modify other plugins or system-wide settings; its register() function throws an error to prevent use.