qingtui

This plugin's code, docs, and configuration are coherent with its stated purpose (connecting QingTui via WebSocket); nothing requests unrelated secrets or surprising privileges, though you should review dependencies before installing.

This repository appears to be a legitimate OpenClaw channel plugin for QingTui. Before installing, (1) verify you obtained the plugin from a trusted source (official repo or npm package) and prefer the registry npmjs.org rather than an unknown private mirror; (2) review package-lock/yarn.lock and, if you must run npm install, do so in an isolated environment (container or VM) to reduce supply-chain risk; (3) keep your QingTui App Secret confidential and only store it in OpenClaw's config, and rotate it if you suspect it was exposed during testing; (4) be aware the plugin will open outbound WebSocket connections to the configured endpoint (default wss://open.qingtui.com) and will download/save inbound media to the OpenClaw media area — ensure that behavior is acceptable in your environment. If you want higher assurance, ask the publisher for a signed release tarball or a reproducible build, and audit the dependency tree (especially any packages pulled from non-standard registries).