Security audit

multi-clawd

Security checks across malware telemetry and agentic risk

Overview

This package is a disclosed multi-account Claude/OpenClaw integration that handles credentials and optional watchdog persistence for its stated failover purpose.

Install only if you want this machine to use multiple Claude accounts for OpenClaw failover. Review the configured account token sources, prefer secret references over plaintext token files, use dry-run for setup/Hermes sync, and skip the watchdog if you do not want a user-level timer that can restart the OpenClaw gateway.

SkillSpector

By NVIDIA

SkillSpector was not run because this plugin release contains no bundled skills.

VirusTotal

58/58 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/shim.js:90
Evidence: const child = spawn(command, childArgs, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: dist/watchdog-schedule.js:112
Evidence: const r = spawnSync(process.execPath, [script], { stdio: "inherit" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cli.mjs:81
Evidence: const r = spawnSync(process.execPath, [join(__dirname, script), ...args], { stdio: "inherit" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/hermes.mjs:181
Evidence: const probe = spawnSync(python, ["-c", probeCode], {