Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/services/agent-events.js:73
- Evidence
export async function __testing_readModernHooksConfig(env = process.env) {
Security audit
Hi Openclaw Plugin
Security checks for vulnerabilities and agentic risk
Overview
Review is needed because this integration broadens agent permissions automatically and can activate legacy background messaging without separate approval.
Static analysis
Detected: suspicious.env_credential_access