NetEase IM (云信)
Security checks across malware telemetry and agentic risk
Overview
The package is an internally consistent OpenClaw channel plugin for NetEase NIM: it matches its name/description, requires credentials via OpenClaw config (nimToken) rather than unexpected system credentials, and has no install-time surprises — but it exposes optional streaming-to-server features that you should configure carefully.
This plugin appears to be what it says: an OpenClaw NetEase NIM channel that uses nimToken credentials configured inside OpenClaw. Before installing, verify the plugin package source (trust the registry/owner), and only provide bot account credentials (AppKey/accid/token) via OpenClaw config as documented. Pay attention to the optional streaming feature: if you enable the streaming server URL or auth token, the plugin will forward message chunks (including generated text and associated metadata) to that endpoint — only point this at a server you control or trust, use HTTPS and an auth token, and apply rate-limiting/logging on the receiver. Review package.json and bundledDependencies in the published package if you require additional assurance, and consider installing/running the plugin in a sandboxed environment or test instance first. If you want a deeper check, provide the package.json and any postinstall scripts from the published artifact so I can inspect dependencies and install-time behavior.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings