Community code plugin. Review compatibility and verification before install.
Latest release: v0.2.3Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The package is a channel plugin for receiving mAICenter dashboard messages and sending agent replies back to api.maicenter.org; that external message bridge is high-impact but matches the stated purpose.
Instruction Scope
Runtime instructions are limited to explaining how inbound mAICenter messages arrive and how the agent should use the reply tool or OpenClaw channel pipeline.
Install Mechanism
The artifact is an npm-pack style plugin with executable JavaScript and a bundled MCP server path; install metadata declares the channel, config schema, setup entry, and required agent key.
Credentials
Network access is scoped to the mAICenter API host for polling messages and posting replies, with no evidence of unrelated local file indexing, shell execution, destructive actions, or hidden outbound destinations.
Persistence & Privilege
The configure skill stores MAICENTER_AGENT_KEY under ~/.claude/channels/maicenter/.env with chmod 600 and supports clearing it; OpenClaw config also supports storing the agent key.
Scan Findings in Context
[SQP-2] expected: The flagged message-content and metadata forwarding is the core behavior of a channel bridge; channel IDs, message IDs, user identity, and timestamps are used for routing, session recording, and replies rather than unrelated disclosure.
[SQP-2] expected: The flagged credential persistence is disclosed by the configure skill, includes the exact file path and restrictive permissions, and is proportionate for authenticating the channel server.
Assessment
Install only if you intend mAICenter users who can message your agent to have those messages processed by your local OpenClaw agent and receive replies. Treat the sk_agent key like a password, keep the machine account private, and remove the stored key or disable the channel when you no longer want this bridge active.server.mjs:2893
Dynamic code execution detected.
server.mjs:14472
Environment variable access combined with network send.
server.ts:24
Environment variable access combined with network send.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.