Security audit
OSCAR
Security checks for vulnerabilities and agentic risk
Overview
This package appears to be a disclosed OpenClaw chat-channel plugin that connects agents to a configured OSCAR/AIM-style server, with no hidden install-time behavior found.
Install only if you intend to let the named OSCAR screen names reach this agent. Keep the owners list very short, use TLS and a server that enforces passwords, avoid the dangerous open-DM/unauthenticated-server options unless you accept that risk, and review any fallback routes or room trust settings before enabling them.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.