Openclaw Exec Truncate
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, instructions, and configuration are internally consistent with its stated purpose (truncating exec/bash output); it does not request unrelated credentials or elevated privileges and does not contain obvious exfiltration behavior.
This plugin appears to do exactly what it claims: intercept exec/bash tool outputs and truncate them by domain. Before installing, consider: 1) Review and test in a safe environment so you understand which outputs get truncated (truncation may hide lines you wanted to inspect). 2) If installing from source and running npm install, be aware the repository includes a package-lock with many transitive dev packages (e.g., AWS/Anthropic libraries); installing dev deps locally can pull large dependency trees — prefer installing via the OpenClaw plugin mechanism. 3) The included uninstall.sh can alter your openclaw.json (it documents a backup step), but review the script before running it and optionally set OPENCLAW_CONFIG_PATH to a non-default location when testing. 4) If you rely on full raw outputs for debugging or for secrets in build logs, disable the plugin or per-domain configuration before use. Overall the package is coherent with low apparent risk, but always inspect and test plugins before deploying in sensitive environments.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings