Back to plugin

Security audit

Newsdance OpenClaw Plugin Test

Security checks for vulnerabilities and agentic risk

Overview

The plugin's code, instructions, and declared config are consistent with its stated purpose (connecting to a Newsdance relay over WebSocket and delivering messages via OpenClaw); nothing indicates misdirection or unexpected privileges — but review the relay host and any relay token you supply before installing.

This plugin appears to do exactly what it says: it connects to a Newsdance relay over WebSocket and forwards events to an OpenClaw delivery target. Before installing: 1) Verify and trust the relay_url host you will connect to (default points at a third-party Railway app). 2) Provide a dedicated relay token with least privilege and confirm the config references the correct env variable name (README uses NEWSDANCE_OPENCLAW_RELAY_TOKEN). 3) Note the registry metadata did not list required env variables even though the plugin uses one; prefer to set the token in plugin config (or a specific env var) rather than exposing broader environment secrets. If you need higher assurance, review the included source (src/) yourself to confirm behavior and rotate any token used for testing.

Static analysis

No suspicious patterns detected.