Security audit
Inworld
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently adds an Inworld text-to-speech provider and only uses the expected API key and network calls needed for that purpose.
Before installing, confirm you intend to use Inworld speech and provide the API key only through OpenClaw configuration or INWORLD_API_KEY. Avoid overriding baseUrl unless you trust the endpoint, because the plugin sends the Inworld API key and text for synthesis to that URL.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.