Security audit
ReefClaw Trading
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed trading plugin, but it includes high-impact remote control and local security-setting changes that users should review carefully before installing.
Install only if you are comfortable giving this plugin live trading authority, persistent local credential storage, dashboard telemetry, remote signed instruction updates, and a connector that can run its own fixed update command. Review the OpenClaw gateway auth fallback carefully, keep the gateway bound to localhost, and verify exchange API keys are limited to the minimum trading permissions you intend.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.