Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/src/proxy-manager.js:83
- Evidence
const proc = spawn(binary, args, {
Security audit
Aquaman: API Key Protection
Security checks for vulnerabilities and agentic risk
Overview
The plugin's credential-proxy behavior is disclosed and purpose-aligned, but it handles sensitive credentials and should be installed only when you want that local proxy model.
Install this only if you intentionally want OpenClaw traffic routed through Aquaman's local credential proxy. Keep the services list narrow, verify the aquaman-proxy binary/version being used, configure request policies, and understand that agents cannot read raw keys but can still cause allowed requests to be sent through the proxy while it is running.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.dangerous_exec