Opera News Plugin
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, manifest, and runtime instructions are coherent with its stated purpose (providing access to Opera News feeds); it requests no credentials, has no install step, and uses only expected network calls to the configured news API.
This plugin appears to implement exactly what it claims: a news-fetching client exposed as OpenClaw tools. Before installing: (1) confirm the plugin config (apiBaseUrl) points to a trusted Opera News endpoint; (2) avoid passing sensitive device identifiers (the code notes device_id may be logged but is redacted); (3) be aware the client exposes geolocation endpoints — if called without an explicit IP they may use the agent/gateway IP, so avoid calling those without intent; (4) if you rely on local .env files for testing, check their contents — production OpenClaw config should override them. If you need higher assurance, review the utils/config.ts and logger redaction logic in source to ensure no local environment secrets can be leaked.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings