Security audit
pixcli
Security checks across malware telemetry and agentic risk
Overview
This media-generation skill is coherent and disclosed, but users should know that referenced files and generated outputs are sent to pixcli and may be public by default.
Install only if you are comfortable sending prompts, text, and any referenced local media files to the configured pixcli API. Set defaultPublish to private or use per-call publish controls for sensitive work, avoid passing private local paths unless you intend to upload them, and run the plugin on a patched OpenClaw host.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.