Pinclaw

• Risk level: Low
• Analyzed: May 19, 2026, 10:51 PM
• Findings: 0
• Version: 0.2.9
• Hash: a978ed987d8156bca6014b52ea558ee7fe1ee7bdf504bc809a3c34bfdf9f8282

Overview

No artifact-backed suspicious or malicious behavior was identified, but the workspace artifacts could not be inspected in this run.

Treat this as an incomplete low-confidence review. The supplied VirusTotal telemetry was stale and not enough by itself to support a suspicious or malicious verdict; inspect metadata.json and the artifact directory before installing.

Publisher note

Uses process.env to read user-configured API keys (TTS, image gen). Uses fetch for external AI API calls and relay media upload. Dynamic import of child_process only in CLI login flow to restart OpenClaw gateway. Never called at plugin runtime.