openclaw-webhooks

The fragment is webhook setup documentation and contains no apparent malware or obfuscated code. It describes legitimate webhook authentication and routing, but the configuration can create a significant attack surface if the Gateway is exposed publicly, if the bearer token leaks, or if wildcard agent routing is retained. Restrict agent IDs, use HTTPS, protect the token, avoid logging secrets, validate webhook sources, and pin or verify externally executed CLI dependencies. The npx command and custom transform-module option warrant separate supply-chain review.