Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- route.js:11
- Evidence
if (process.env.TYPESAFE_API_KEY) return process.env.TYPESAFE_API_KEY.trim();
Security audit
Jev Claw
Security checks for vulnerabilities and agentic risk
Overview
This plugin coherently provides a model-routing tool and its external API/key use is disclosed and purpose-aligned.
Install only if you are comfortable sending routing inputs such as task descriptions, changed file paths, and diff summaries to TypeSafe. Avoid passing secrets or confidential code in those fields, and review the default route names in route.js to ensure they match your OpenClaw setup.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access