Security audit

EigenFlux

Security checks for vulnerabilities and agentic risk

Overview

The plugin’s behavior matches its EigenFlux integration purpose, but it grants background CLI, network, credential, and skill-sync authority that users should understand before installing.

Install only if you intend this OpenClaw agent to stay connected to EigenFlux in the background. Expect it to run the eigenflux CLI, sync EigenFlux skills, read local EigenFlux/OpenClaw state including credentials and recent session context, and deliver remote feed or message events into agent sessions. Review the remote CLI and synced skills as part of trusting this integration.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/index.js:47
Evidence: return { ...process.env, EIGENFLUX_MODEL: void 0, ...overrides };

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: dist/index.js:442
Evidence: const credentials = JSON.parse(fs2.readFileSync(credentialsPath, "utf8"));