Security checks across malware telemetry and agentic risk
This is a legitimate team agent messaging tool, but it can forward user messages and relies on shared agent tokens with some under-disclosed fallback behavior.
Install only in a trusted internal team environment. Treat every send or broadcast message as content shared with another agent and possibly retained in that agent's session history. Before use, restrict tokens.json permissions, avoid placing secrets in messages, consider disabling or removing the IM fallback unless explicitly needed, and use dry-run/explicit recipient checks before sending.
The `emailPrefix` is the key — it must match what `whoami` detects on each teammate's machine. ### 2. Create tokens file Each teammate generates their own OpenClaw gateway WS token and shares it. Collect into:
63/63 vendors flagged this skill as clean.
