Security audit
StepFun OpenClaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
The plugin appears to do exactly what it says — register two StepFun model providers and use a single StepFun API key — with no unexplained network endpoints, downloads, or privileged behavior.
This plugin is coherent with its stated purpose: it registers two StepFun providers and expects a single STEPFUN_API_KEY. Before installing: 1) Confirm you trust the source (repository URL in package.json) and that you intend to provide STEPFUN_API_KEY to OpenClaw, since the key will be stored as provider auth. 2) Note the small metadata mismatch: the registry entry didn't declare the env var, but the plugin and docs require it — ensure your install flow supplies the key. 3) If you have policies limiting third-party API keys, verify what rights the StepFun API key grants and consider using a scoped/test key. 4) As usual, review OpenClaw's stored auth locations and rotate the key if you later remove the plugin.
Static analysis
No suspicious patterns detected.
