Security audit

UnraidClaw

Security checks for vulnerabilities and agentic risk

Overview

This plugin openly provides broad Unraid server administration tools and uses the configured UnraidClaw gateway and API key rather than hidden local or unrelated access.

Install only if you want an AI agent to have the Unraid permissions granted to its UnraidClaw API key. Use the UnraidClaw permission matrix to limit destructive actions, prefer secret-backed API keys, avoid tlsSkipVerify unless needed for a trusted local self-signed certificate, and require explicit confirmation before plugin installs, removals, reboot, shutdown, or array/container destructive operations.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.insecure_tls_verification, suspicious.install_untrusted_source

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: README.md:24
Evidence: rm -rf ~/.openclaw/extensions/unraidclaw && npm pack unraidclaw && openclaw plugins install unraidclaw-*.tgz && rm unraidclaw-*.tgz

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: dist/index.js:24
Evidence: this.insecureAgent = new HttpsAgent({ rejectUnauthorized: false });

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: openclaw.plugin.json:192
Evidence: "placeholder": "https://192.168.1.100:9876"