Latest release: v2026.7.1Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The package purpose, README, CLI, and code align around offline OpenClaw plugin inspection: reading plugin manifests, package metadata, source files, optional OpenClaw compatibility surfaces, and writing local reports.
Instruction Scope
Default inspection is static, offline, and credential-free. Runtime capture that imports plugin code is explicitly gated by --allow-execute or PLUGIN_INSPECTOR_EXECUTE_ISOLATED.
Install Mechanism
The package is from the trusted @openclaw publisher, has no install/postinstall lifecycle script, exposes a plugin-inspector CLI, and VirusTotal telemetry was clean.
Credentials
The tool reads plugin roots and optional OpenClaw checkout paths, writes reports, and can batch-scan folders; this is proportionate for compatibility inspection but should be pointed only at intended repositories.
Persistence & Privilege
No hidden background persistence, privilege escalation, or auth/session-store use was found. The init command can write config, workflow, and package script files only when invoked, with dry-run and overwrite protections.
Scan Findings in Context
[SkillSpector] expected: No advisory SkillSpector findings were supplied.
[VirusTotal] expected: Telemetry reported 0 malicious and 0 suspicious engines; this supports the verdict but was not treated as decisive by itself.
[static-review-runtime-execution] expected: Process spawning and plugin imports are tied to opt-in runtime capture/profiling workflows and are disclosed in the README and CLI help.
[static-review-local-writes] expected: File writes are local report artifacts or explicit init-generated files; temporary batch cleanup deletes only a tool-created temp directory.
Assessment
Safe to install for normal plugin compatibility checks. Use the default static mode for untrusted plugins, and only run --runtime/--allow-execute or generated CI workflows in an isolated environment because that mode imports the plugin code being inspected.Verification
Tags
@openclaw/diagnostics-prometheus
Official Prometheus diagnostics exporter for OpenClaw.
This plugin exposes OpenClaw Gateway runtime metrics in Prometheus text format for Prometheus, Grafana, VictoriaMetrics, and compatible scrapers.
Install
openclaw plugins install @openclaw/diagnostics-prometheus
Restart the Gateway after installing or updating the plugin.
Configure
Enable the plugin and set the scrape endpoint options in plugins.entries.diagnostics-prometheus.config.
The full config surface, metric names, and scrape examples live in the docs:
Package
- Plugin id:
diagnostics-prometheus - Package:
@openclaw/diagnostics-prometheus - Minimum OpenClaw host:
2026.4.25