Security audit
Surplus Intelligence
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed Surplus Intelligence account-management plugin, but it handles wallet/API secrets and USDC approval actions that users should treat carefully.
Install only if you intend to manage a Surplus Intelligence account from OpenClaw. Use a dedicated low-risk wallet for CLAWDBOT_WALLET_PRIVATE_KEY, verify INFERENCE_API_URL is the Surplus Intelligence host you trust, keep plugin config and chat transcripts private, and revoke/rotate any buyer or seller API key that appears in a shared chat.
VirusTotal
59/59 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.