Plugin
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, configuration, and runtime instructions are internally consistent with its stated purpose (a managed WhatsApp channel that routes traffic through imBee); the main risk is that traffic is proxied through an external service you must trust.
This plugin is coherent: it implements a managed WhatsApp Business channel that routes traffic through imBee's routing service. Before installing, consider these points: 1) Messages (and media) will transit imBee's infrastructure (openclaw-plugin.dev.ent.imbee.io) and are delivered using an apiKey you must provision — you must trust imBee's handling of in-flight data despite their in-memory-only claim. 2) The plugin stores the pairing/apiKey in OpenClaw config (store secrets appropriately). 3) Test with a throwaway number and verify TLS endpoints and WebSocket behavior before using it with sensitive data. 4) The licence forbids self-hosted routing for production — you must use imBee's service unless you purchase a commercial licence. If you need stronger assurance, ask the maintainer for audited documentation of the routing server (code, retention policy, HMAC verification details) or request the ability to self-host.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings