Security audit
Newsdance OpenClaw Plugin Test
Security checks for vulnerabilities and agentic risk
Overview
The plugin's code, instructions, and declared config are consistent with its stated purpose (connecting to a Newsdance relay over WebSocket and delivering messages via OpenClaw); nothing indicates misdirection or unexpected privileges — but review the relay host and any relay token you supply before installing.
This plugin appears to do exactly what it says: it connects to a Newsdance relay over WebSocket and forwards events to an OpenClaw delivery target. Before installing: 1) Verify and trust the relay_url host you will connect to (default points at a third-party Railway app). 2) Provide a dedicated relay token with least privilege and confirm the config references the correct env variable name (README uses NEWSDANCE_OPENCLAW_RELAY_TOKEN). 3) Note the registry metadata did not list required env variables even though the plugin uses one; prefer to set the token in plugin config (or a specific env var) rather than exposing broader environment secrets. If you need higher assurance, review the included source (src/) yourself to confirm behavior and rotate any token used for testing.
Static analysis
No suspicious patterns detected.
