Vibe Dot
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, README, and runtime instructions are consistent: it opens an SSE connection to a documented relay URL using a channel token and optionally posts agent replies to a user-provided Slack webhook.
This plugin is coherent with its description: it opens an SSE connection to the documented relay (https://demo-dot-relay.vibeus.workers.dev/dot-messages) using the token you provide in OpenClaw config, and will forward agent replies only if you supply a Slack webhook URL. Before enabling: (1) confirm you trust the SSE relay (the plugin sends your bearer token to that endpoint to authenticate the stream), (2) be careful when supplying a Slack webhook because agent replies will be posted to that destination (don’t use a webhook you don’t control), and (3) note that developer-local files (.claude/settings.local.json) contain dev-time helper commands referencing local paths — these are not executed at runtime but indicate developer testing setup. If you trust the relay and control the webhook, the plugin appears to do what it says.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings