Openclaw Seatalk

Security checks across malware telemetry and agentic risk

Overview

This SeaTalk plugin mostly matches its stated chat-integration purpose, but it grants broad access to workplace messages and can send bot secrets to a configured relay service, so it should be reviewed before installation.

Install only if you control the SeaTalk bot app and can restrict who may message it. Prefer webhook mode or a trusted wss:// relay you operate, avoid ws:// relay URLs, disable unneeded history/get-message tools, keep groupPolicy on allowlist or disabled, and treat all enabled chats and media as content that can enter the agent context and be stored in OpenClaw sessions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (35)

Context-Inappropriate Capability

Medium
Confidence
80% confidence
Finding
Because no manifest is available, the skill's stated purpose is unknown. The code nevertheless exposes capabilities to read group chat history, list joined groups, inspect group info, fetch DM/group thread contents, and retrieve arbitrary messages by message ID via the client and tools configuration, which are more expansive than basic send/receive channel plumbing and are not justified by any declared purpose here.

Intent-Code Divergence

Low
Confidence
71% confidence
Finding
The setup text presents relay mode as merely connecting to a relay service, but the relay implementation authenticates by sending appId, appSecret, and signingSecret over the WebSocket connection. While there is a warning for ws:// later, the documentation around the mode choice understates the sensitive behavior of relay mode and can mislead operators about what the code actually does.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This markdown file documents capabilities that process private chats, group messages, files/images, quoted-message resolution, and media downloads, which can affect user privacy and expose conversation content to the agent. The README explains features and setup but does not include an explicit warning that enabling these features may ingest message history and media into AI context.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This code prompts for `appSecret` and `signingSecret` and then sends them over the relay WebSocket as part of an auth message. Although there is a warning for `ws://` during setup, the code path that actually performs relay auth lacks an in-code disclosure or confirmation at the point of transmission, and the operation involves credential transmission over the network.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The relay connection authenticates by sending appId, appSecret, and signingSecret in a WebSocket message during connectSeaTalkRelay/it, but this code path has no runtime warning, confirmation, or log when the configured relay URL uses insecure ws://. Although the setup wizard warns interactively elsewhere, this code file itself performs credential transmission and lacks a user-facing disclosure or safeguard at the point of execution.

Context Leakage

High
Category
Data Exfiltration
Content
import {buildChannelConfigSchema,defineChannelPluginEntry,DEFAULT_ACCOUNT_ID,normalizeAccountId,stripChannelTargetPrefix,buildChannelOutboundSessionRoute,buildThreadAwareOutboundSessionRoute}from'openclaw/plugin-sdk/core';import {getChildLogger}from'openclaw/plugin-sdk/runtime-env';import*as L from'fs';import*as Be from'os';import*as W from'path';import {resolveMediaBufferPath}from'openclaw/plugin-sdk/media-store';import {resolveSendableOutboundReplyParts,sendMediaWithLeadingCaption}from'openclaw/plugin-sdk/reply-payload';import {createChannelMessageReplyPipeline}from'openclaw/plugin-sdk/channel-outbound';import {createPairingPrefixStripper,createChannelPairingController}from'openclaw/plugin-sdk/channel-pairing';import {resolveDmGroupAccessWithLists,DM_GROUP_ACCESS_REASON}from'openclaw/plugin-sdk/channel-policy';import {resolveThreadSessionKeys}from'openclaw/plugin-sdk/routing';import {resolveStorePath}from'openclaw/plugin-sdk/session-store-runtime';import In from'ws';import*as ge from'crypto';import*as kt from'http';import {PAIRING_APPROVED_MESSAGE}from'openclaw/plugin-sdk/channel-plugin-common';import {z as z$1}from'zod';import {createTopLevelChannelDmPolicy,createStandardChannelSetupStatus,mergeAllowFromEntries}from'openclaw/plugin-sdk/setup';import {Type}from'@sinclair/typebox';var _t=Object.defineProperty;var $=(e,t)=>()=>(e&&(t=e(e=0)),t);var _e=(e,t)=>{for(var o in t)_t(e,o,{get:t[o],enumerable:true});};function Pt(e){let t=e.channels?.seatalk?.accounts;return !t||typeof t!="object"?[]:Object.keys(t).filter(Boolean)}function re(e){let t=Pt(e);return t.length===0?[DEFAULT_ACCOUNT_ID]:[...t].toSorted((o,n)=>o.localeCompare(n))}function me(e){let t=re(e);return t.includes(DEFAULT_ACCOUNT_ID)?DEFAULT_ACCOUNT_ID:t[0]??DEFAULT_ACCOUNT_ID}function At(e,t){let o=e.channels?.seatalk?.accounts;if(!(!o||typeof o!="object"))return o[t]}function xt(e,t){let o=e.channels?.seatalk,{accounts:n,...a}=o??{},r=At(e,t)??{};return {...a,...r}}function U(e){let t=e?.appId?.trim(),
...[truncated 27 chars]
Confidence
85% confidence
Finding
record session

Context Leakage

High
Category
Data Exfiltration
Content
import {buildChannelConfigSchema,defineSetupPluginEntry,DEFAULT_ACCOUNT_ID,normalizeAccountId,stripChannelTargetPrefix,buildChannelOutboundSessionRoute,buildThreadAwareOutboundSessionRoute}from'openclaw/plugin-sdk/core';import {getChildLogger}from'openclaw/plugin-sdk/runtime-env';import*as R from'fs';import*as Re from'os';import*as H from'path';import {resolveMediaBufferPath}from'openclaw/plugin-sdk/media-store';import {resolveSendableOutboundReplyParts,sendMediaWithLeadingCaption}from'openclaw/plugin-sdk/reply-payload';import {createChannelMessageReplyPipeline}from'openclaw/plugin-sdk/channel-outbound';import {createPairingPrefixStripper,createChannelPairingController}from'openclaw/plugin-sdk/channel-pairing';import {resolveDmGroupAccessWithLists,DM_GROUP_ACCESS_REASON}from'openclaw/plugin-sdk/channel-policy';import {resolveThreadSessionKeys}from'openclaw/plugin-sdk/routing';import {resolveStorePath}from'openclaw/plugin-sdk/session-store-runtime';import kn from'ws';import*as de from'crypto';import*as dt from'http';import {PAIRING_APPROVED_MESSAGE}from'openclaw/plugin-sdk/channel-plugin-common';import {z as z$1}from'zod';import {createTopLevelChannelDmPolicy,createStandardChannelSetupStatus,mergeAllowFromEntries}from'openclaw/plugin-sdk/setup';var pt=Object.defineProperty;var M=(e,t)=>()=>(e&&(t=e(e=0)),t);var ye=(e,t)=>{for(var o in t)pt(e,o,{get:t[o],enumerable:true});};function ht(e){let t=e.channels?.seatalk?.accounts;return !t||typeof t!="object"?[]:Object.keys(t).filter(Boolean)}function ee(e){let t=ht(e);return t.length===0?[DEFAULT_ACCOUNT_ID]:[...t].toSorted((o,n)=>o.localeCompare(n))}function fe(e){let t=ee(e);return t.includes(DEFAULT_ACCOUNT_ID)?DEFAULT_ACCOUNT_ID:t[0]??DEFAULT_ACCOUNT_ID}function kt(e,t){let o=e.channels?.seatalk?.accounts;if(!(!o||typeof o!="object"))return o[t]}function St(e,t){let o=e.channels?.seatalk,{accounts:n,...a}=o??{},r=kt(e,t)??{};return {...a,...r}}function F(e){let t=e?.appId?.trim(),o=e?.appSecret?.trim(),n=e?.signingSecr
...[truncated 27 chars]
Confidence
85% confidence
Finding
record session

Scope Creep

Low
Category
Excessive Agency
Content
exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical
Confidence
70% confidence
Finding
not limited to

Scope Creep

Low
Category
Excessive Agency
Content
"Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.

      "Work" shall mean the work of authorship, whether in Source or
Confidence
70% confidence
Finding
not limited to

Scope Creep

Low
Category
Excessive Agency
Content
or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
Confidence
70% confidence
Finding
not limited to

Scope Creep

Low
Category
Excessive Agency
Content
liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
Confidence
70% confidence
Finding
not limited to

Credential Access

High
Category
Privilege Escalation
Content
- **Dual gateway mode** — **webhook** (direct HTTP server) or **relay** (WebSocket client via [seatalk-relay](https://github.com/lf4096/seatalk-relay))
- **Security** — SHA256 signature verification for all incoming events
- **Token management** — automatic access token obtain, cache, and refresh
- **Outbound coalescing** — consecutive reply payloads are merged into a single message with automatic markdown-aware chunking at 4000 chars; configurable via `outboundCoalescing`
- **Deduplication** — event ID dedup + per-sender debounce buffer (thread-aware)
- **Access control** — DM policy (`open`/`allowlist`/`pairing`), group policy (`disabled`/`allowlist`/`open`), per-group and per-sender allow-lists
Confidence
70% confidence
Finding
access token

Exfiltration Commands

High
Category
Prompt Injection
Content
3. Get **Signing Secret** from Event Callback settings
4. Enable Bot capability and set status to **Online**
5. Enable required permissions:
   - **Send Message to Bot User**
   - **Get Employee Code with Email** (for email-to-employee_code resolution)
   - **Set Typing Status in Private Chat** (for DM processing indicator)
   - **Set Typing Status in Group Chat** (for group processing indicator)
Confidence
90% confidence
Finding
Send Message to

Exfiltration Commands

High
Category
Prompt Injection
Content
`)}`:"[Forwarded messages]");}break}}}let b=i.groupEvent.message.quoted_message_id,h=null;if(b){let x=await Te({client:n,quotedMessageId:b,mediaAllowHosts:S});x&&(h=x.text,w.push(...x.media));}let I=T.join(`
`);if(h&&(I=I?`${h}
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abor
...[truncated 27 chars]
Confidence
90% confidence
Finding
Send Message to

Exfiltration Commands

High
Category
Prompt Injection
Content
`);if(h&&(I=I?`${h}
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecre
...[truncated 27 chars]
Confidence
90% confidence
Finding
Send Message to

Exfiltration Commands

High
Category
Prompt Injection
Content
`)}`:"[Forwarded messages]");}break}}}let T=i.groupEvent.message.quoted_message_id,h=null;if(T){let E=await Se({client:n,quotedMessageId:T,mediaAllowHosts:k});E&&(h=E.text,S.push(...E.media));}let v=y.join(`
`);if(h&&(v=v?`${h}
${v}`:h),!v&&S.length>0&&(v=S.map(E=>E.placeholder).join(" ")),!v&&S.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:d});return}let P=d+(g?` (${g})`:""),A=l.message_id,ue=e.some(E=>E.eventType==="new_mentioned_message_received_from_group_chat"),Q=i.groupEvent.message.message_sent_time,L={groupId:s};p&&(L.threadId=p),T&&(L.quotedMessageId=T);try{await ot({ctx:t,chatType:"group",peerId:s,from:`seatalk:${d}`,to:s,senderId:d,senderName:P,messageId:A,threadId:p,wasMentioned:ue,timestampMs:Q?Q*1e3:Date.now(),messageText:v,mediaList:S,useThreadSession:(w?.groupThreadSession??!0)&&!!p,metadata:L});}catch(E){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(E)});}}var nn,on,an,z,Ze,rn,sn,et,se,we=M(()=>{Ye();N();Qe();q();oe();ne();Y();nn=1800*1e3,on=1e3,an=300*1e3,z=new Map,Ze=Date.now();rn=4e3,sn=3e3,et=1500;});var st={};ye(st,{connectSeaTalkRelay:()=>Tn});function yn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function it(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=b("relay"),l=F(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=$(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let d=at;for(;!r?.aborted;){try{await new Promise((g,p)=>{if(r?.aborted){g();return}s.info("connecting",{accountId:i,relayUrl:n});let f=new kn(n),w,k=()=>{w&&(clearTimeout(w),w=void 0);},m=()=>{k(),w=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:rt}),f.terminate();},rt);},y=()=>{k(),f.close(),g();};r?.addEventListener("abort"
...[truncated 27 chars]
Confidence
90% confidence
Finding
Send Message to

Exfiltration Commands

High
Category
Prompt Injection
Content
`);if(h&&(v=v?`${h}
${v}`:h),!v&&S.length>0&&(v=S.map(E=>E.placeholder).join(" ")),!v&&S.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:d});return}let P=d+(g?` (${g})`:""),A=l.message_id,ue=e.some(E=>E.eventType==="new_mentioned_message_received_from_group_chat"),Q=i.groupEvent.message.message_sent_time,L={groupId:s};p&&(L.threadId=p),T&&(L.quotedMessageId=T);try{await ot({ctx:t,chatType:"group",peerId:s,from:`seatalk:${d}`,to:s,senderId:d,senderName:P,messageId:A,threadId:p,wasMentioned:ue,timestampMs:Q?Q*1e3:Date.now(),messageText:v,mediaList:S,useThreadSession:(w?.groupThreadSession??!0)&&!!p,metadata:L});}catch(E){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(E)});}}var nn,on,an,z,Ze,rn,sn,et,se,we=M(()=>{Ye();N();Qe();q();oe();ne();Y();nn=1800*1e3,on=1e3,an=300*1e3,z=new Map,Ze=Date.now();rn=4e3,sn=3e3,et=1500;});var st={};ye(st,{connectSeaTalkRelay:()=>Tn});function yn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function it(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=b("relay"),l=F(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=$(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let d=at;for(;!r?.aborted;){try{await new Promise((g,p)=>{if(r?.aborted){g();return}s.info("connecting",{accountId:i,relayUrl:n});let f=new kn(n),w,k=()=>{w&&(clearTimeout(w),w=void 0);},m=()=>{k(),w=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:rt}),f.terminate();},rt);},y=()=>{k(),f.close(),g();};r?.addEventListener("abort",y,{once:!0}),f.on("upgrade",T=>{T.socket.setKeepAlive(!0,6e4);}),f.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),f.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,
...[truncated 27 chars]
Confidence
90% confidence
Finding
Send Message to

Session Persistence

Medium
Category
Rogue Agent
Content
tools: {
        groupInfo: true,
        groupHistory: true,
        groupList: true,
        threadHistory: true,
        getMessage: true,
      },
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
| `mediaAllowHosts` | string[] | `["openapi.seatalk.io"]` | Allowed hostnames for inbound media downloads (HTTPS only) |
| `tools.groupInfo` | boolean | `true` | Enable `seatalk` tool `group_info` action |
| `tools.groupHistory` | boolean | `true` | Enable `seatalk` tool `group_history` action |
| `tools.groupList` | boolean | `true` | Enable `seatalk` tool `group_list` action |
| `tools.threadHistory` | boolean | `true` | Enable `seatalk` tool `thread_history` action |
| `tools.getMessage` | boolean | `true` | Enable `seatalk` tool `get_message` action |
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${v.lines.join(`
`)}`:"[Forwarded messages]");}break}}}let b=i.groupEvent.message.quoted_message_id,h=null;if(b){let x=await Te({client:n,quotedMessageId:b,mediaAllowHosts:S});x&&(h=x.text,w.push(...x.media));}let I=T.join(`
`);if(h&&(I=I?`${h}
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEv
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,signingSecret:l}))
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,signingSecret:l}))
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,signingSecret:l}))
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,signingSecret:l}))
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

Session Persistence

Medium
Category
Rogue Agent
Content
${I}`:h),!I&&w.length>0&&(I=w.map(x=>x.placeholder).join(" ")),!I&&w.length===0){r.info("group empty, skipping",{accountId:a,groupId:s,employeeCode:u});return}let R=u+(d?` (${d})`:""),A=l.message_id,pe=e.some(x=>x.eventType==="new_mentioned_message_received_from_group_chat"),oe=i.groupEvent.message.message_sent_time,F={groupId:s};p&&(F.threadId=p),b&&(F.quotedMessageId=b);try{await dt({ctx:t,chatType:"group",peerId:s,from:`seatalk:${u}`,to:s,senderId:u,senderName:R,messageId:A,threadId:p,wasMentioned:pe,timestampMs:oe?oe*1e3:Date.now(),messageText:I,mediaList:w,useThreadSession:(k?.groupThreadSession??!0)&&!!p,metadata:F});}catch(x){r.error("group dispatch failed",{accountId:a,groupId:s,err:String(x)});}}var gn,pn,fn,V,it,mn,hn,st,ce,be=$(()=>{nt();j();rt();z();ie();Q();X();gn=1800*1e3,pn=1e3,fn=300*1e3,V=new Map,it=Date.now();mn=4e3,hn=3e3,st=1500;});var ft={};_e(ft,{connectSeaTalkRelay:()=>En});function xn(e,t){return new Promise(o=>{let n=()=>{clearTimeout(a),o();},a=setTimeout(()=>{t?.removeEventListener("abort",n),o();},e);t?.addEventListener("abort",n,{once:true});})}async function pt(e){let{cfg:t,account:o,relayUrl:n,runtime:a,abortSignal:r}=e,{accountId:i}=o,s=C("relay"),l=U(o.config)?.signingSecret;if(!o.appId||!o.appSecret||!l)throw new Error(`SeaTalk account "${i}" missing credentials for relay mode`);let c=M(o);if(!c)throw new Error(`SeaTalk client not available for account "${i}"`);let u=ut;for(;!r?.aborted;){try{await new Promise((d,p)=>{if(r?.aborted){d();return}s.info("connecting",{accountId:i,relayUrl:n});let g=new In(n),k,S=()=>{k&&(clearTimeout(k),k=void 0);},m=()=>{S(),k=setTimeout(()=>{s.error("relay silent, terminating",{accountId:i,timeoutMs:gt}),g.terminate();},gt);},T=()=>{S(),g.close(),d();};r?.addEventListener("abort",T,{once:!0}),g.on("upgrade",b=>{b.socket.setKeepAlive(!0,6e4);}),g.on("open",()=>{m(),s.info("connected, authenticating",{accountId:i}),g.send(JSON.stringify({type:"auth",appId:o.appId,appSecret:o.appSecret,signingSecret:l}))
...[truncated 27 chars]
Confidence
75% confidence
Finding
pList

VirusTotal

60/60 vendors flagged this plugin as clean.

View on VirusTotal