ClawHub
Code Pluginsource linked

chrome-openclaw-siderv1.0.26

Official Chrome channel plugin for connecting OpenClaw in Sider Chrome extension

chrome-openclaw-sider·runtime chrome-openclaw-sider·by @sider
Community code plugin. Review compatibility and verification before install.
openclaw plugins install clawhub:chrome-openclaw-sider
Latest release: v1.0.26Download zip

Compatibility

Built With Open Claw Version
2026.3.22
Min Gateway Version
>=2026.3.22
Plugin Api Range
>=2026.3.22
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
The stated purpose is to connect OpenClaw to the Sider Chrome extension, and outbound chat, streaming, media upload, and pairing behavior fit that purpose. The concern is that the code forwards raw tool parameters/results/errors and can upload locally resolved files, which is broader than simple chat routing or tool-call status.
!
Instruction Scope
The plugin registers generic before/after tool hooks and message/LLM/run hooks for Sider-bound sessions. Those hooks are scoped to Sider session bindings, but they do not visibly redact secrets, file contents, command output, or other sensitive fields before relaying payloads.
ℹ
Install Mechanism
The package is source-linked to Sider-ai/openclaw-sider-plugin and VirusTotal is clean. The quick install path uses an npx installer that downloads and executes at runtime, but the README discloses this and provides manual OpenClaw install/update commands.
!
Credentials
A browser channel reasonably needs network access and media handling, but this implementation opens a persistent relay to Sider and handles arbitrary tool payloads plus local/remote media references, including absolute, home-directory, file URL, and relative path forms.
!
Persistence & Privilege
Pairing persists a long-lived Sider token in ~/.openclaw/openclaw.json and the gateway can keep a relay monitor running. That is expected for a channel plugin, but the artifact does not show granular controls for disabling detailed tool/message capture while keeping the channel enabled.
Scan Findings in Context
[SDI-2] expected: Media upload is expected for a Sider channel, and the README discloses attachment transmission. The concern remains valid because the resolver accepts broad local path forms and upload can occur without a per-file confirmation gate.
[SQP-2] expected: Forwarding chat and tool activity to Sider is purpose-aligned, but the cited hooks/builders send raw tool arguments, results, errors, assistant content, and message-derived data with no visible redaction or detailed opt-in control.
[suspicious.exposed_secret_literal] expected: The static secret findings appear to be false positives: the code formats runtime-provided Authorization tokens and pairing tokens rather than embedding hardcoded credentials.
What to consider before installing
Install only if you trust Sider with the conversations, assistant outputs, tool inputs/results, command output, and attachments from Sider-driven OpenClaw sessions. Avoid using it in sessions that may expose secrets or sensitive local files, prefer the manual install path if you want reviewability, and review the persisted token in ~/.openclaw/openclaw.json after pairing.
✗
dist/src/auth.js:99
File appears to expose a hardcoded API secret or token.
✗
dist/src/channel-auto-title.js:30
File appears to expose a hardcoded API secret or token.
✗
dist/src/channel-util.js:203
File appears to expose a hardcoded API secret or token.
✗
dist/src/inbound-media.js:35
File appears to expose a hardcoded API secret or token.
✗
dist/src/media-upload.js:618
File appears to expose a hardcoded API secret or token.
✗
dist/src/setup-core.js:240
File appears to expose a hardcoded API secret or token.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

Tier
source linked
Scope
artifact only
Summary
Validated package structure and linked the release to source metadata.
Source
github.com/Sider-ai/openclaw-sider-plugin
Commit
edebe067f9a3
Tag
main
Provenance
No
Scan status
suspicious

Tags

latest
1.0.26

Chrome Channel for OpenClaw in Sider

The official Chrome channel plugin for connecting OpenClaw to the Sider Chrome extension.

Once connected, you can control OpenClaw directly from the Sider Chrome sidebar.

【【【 Quick install from the terminal 】】】

Run in Terminal:

================================

npx -y @sider-ai/chrome-openclaw-sider-cli install

================================

This convenience command downloads and executes the installer CLI from npm at runtime. If you prefer a more reviewable path, use the manual openclaw plugins install/update commands below instead.

You can also paste this command into the OpenClaw chat box and ask OpenClaw to install it for you. This will install or update the plugin and automatically start terminal pairing.

【【【 Manual installation 】】】

If the quick install does not work, follow these steps:

【 1. Install or update the plugin 】

Install in Terminal:

================================

openclaw plugins install clawhub:chrome-openclaw-sider

================================

If the plugin is already installed, update it with:

================================

openclaw plugins update clawhub:chrome-openclaw-sider

================================

You can run these commands directly in your terminal, or paste them into the OpenClaw chat box and ask OpenClaw to execute them.

【 2. Pair the plugin with Sider’s Chrome extension using a pairing code 】

Run in Terminal:

================================

openclaw channels login --channel chrome-openclaw-sider

================================

Your terminal will display a short pairing code. Enter this code in the Sider browser extension.

In the Sider Chrome extension, open the Claw widget from the right column of the extension and enter the pairing code there. This will connect the Sider Chrome extension to your OpenClaw instance.

【 3. Restart the gateway 】

After entering the pairing code, restart the gateway in Terminal:

================================

openclaw gateway restart

================================

Data Handling / Security / Privacy

  • The plugin sends Sider conversation content, assistant replies, streaming events, tool-call status, and uploaded attachments to Sider/selfclaw endpoints so Sider can render and route the chat.
  • Pairing or setup exchanges persist the resulting long-lived token into your local OpenClaw config at ~/.openclaw/openclaw.json.
  • When you send a local attachment, the plugin may read files from OpenClaw media roots in order to upload them to Sider. When Sider sends attachments inbound, the plugin may download and save them into OpenClaw-managed media storage.
  • Install and pair this plugin only if you trust the Sider service and are comfortable with the relevant chat content and attachments being transmitted to it.
  • Runtime environment variables: SIDER_BASE_URL overrides the default API base URL, and SIDER_SETUP_TOKEN provides a setup-token fallback for the default account.