Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/proxy-manager.js:83
- Evidence
const proc = spawn(binary, args, {
Security audit
Aquaman: API Key Protection
Security checks across malware telemetry and agentic risk
Overview
The plugin mostly matches its API-key protection purpose, but it starts a local credential proxy that can also return stored secrets directly over its socket, which needs user review before installation.
Before installing, confirm you are comfortable with an OpenClaw plugin that starts a local credential proxy, overrides fetch for selected services, writes OpenClaw credential placeholders or SecretRef wiring, and keeps audit logs. Review whether same-user tools or agents in your environment can access ~/.aquaman/proxy.sock, because the bundled proxy can resolve stored secrets directly through its broker endpoint.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
60/60 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec