Latest release: v2026.7.1Download zip
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The network calls, local file reads/writes, token use, package validation, publishing, download, and delete/restore operations fit the stated CLI purpose.
Instruction Scope
High-impact actions are command-driven and generally scoped by explicit arguments such as skill/package name, path, --dry-run, --force, --yes, or authentication requirements.
Install Mechanism
The reviewed package metadata exposes a CLI bin and build/prepublish scripts; no automatic postinstall execution was found in the published package metadata.
Credentials
The CLI can read local skill/plugin folders, use GitHub and ClawHub network APIs, run npm pack with --ignore-scripts, and optionally run plugin runtime validation only when requested.
Persistence & Privilege
It stores ClawHub API tokens in a user config file with restricted permissions and writes lock/origin metadata under .clawhub; delete, transfer, and publish operations require authentication and explicit invocation.
Scan Findings in Context
[VirusTotal telemetry] expected: VirusTotal reported no malicious or suspicious detections across 61 engines; this is supportive telemetry, not the sole basis for the verdict.
[SkillSpector findings] expected: No SkillSpector findings were supplied.
[Static/non-VT signals] expected: No non-VirusTotal malicious signal was supplied, and artifact review did not show deceptive, hidden, destructive, or purpose-mismatched behavior.
Assessment
Install only if you intend to use ClawHub as a local CLI that can manage skill files, store an API token, and publish or delete registry content when you run those commands. Review commands carefully before using --yes, --force, --all, --allow-execute, or publish/delete operations.Verification
Tags
@openclaw/llama-cpp-provider
Official llama.cpp embedding provider for OpenClaw.
This plugin runs local GGUF embedding models through node-llama-cpp.
Install
openclaw plugins install @openclaw/llama-cpp-provider
Restart the Gateway after installing or updating the plugin. Use Node 24 for native installs and updates.
Configure
Set agents.defaults.memorySearch.provider to local. By default, the plugin
downloads and uses the EmbeddingGemma GGUF model. Configure
agents.defaults.memorySearch.local.modelPath to use another local path, Hugging
Face model URI, or HTTPS model URL.
Package
- Plugin id:
llama-cpp - Package:
@openclaw/llama-cpp-provider - Minimum OpenClaw host:
2026.6.2