byted-security-clawsentry

Warn

Audited by Gen Agent Trust Hub on Mar 26, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/bundle.js uses child_process.execSync and child_process.spawn to interact with the system and the openclaw CLI.
  • It executes openclaw config get plugins to read current settings.
  • It executes openclaw config set plugins to modify the security configuration, including injecting an API key and endpoint.
  • It executes openclaw gateway restart to apply changes.
  • It spawns a detached background process (itself) to poll for login status for up to 10 minutes.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs an external Node.js package.
  • The command openclaw plugins install @omni-shield/ai-assistant-security-openclaw is executed during the setup process.
  • It makes several network requests to openclaw.sdk.access.llm-shield.omini-shield.com for token generation and identity verification.
  • [OBFUSCATION]: The file scripts/bundle.js is a bundled and minified JavaScript file containing polyfills and library code (e.g., electron-machine-id). This makes the full logic of the script difficult to audit manually, although the primary functions related to the skill's purpose are identifiable in the trailing code block.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 26, 2026, 03:03 PM