Security audit

Task Notifier

Security checks for vulnerabilities and agentic risk

Overview

Task Notifier is a clearly disclosed desktop-notification plugin whose local commands, lifecycle hooks, and workspace state files match its stated purpose.

Install only if you are comfortable with an OpenClaw plugin that runs local OS notification commands, checks the active window title, starts with OpenClaw, and receives lifecycle hook access. The artifacts disclose these behaviors and include controls for agent filtering and state cleanup.

SkillSpector

SkillSpector was not run because this plugin release contains no bundled skills.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.js:195
Evidence: execFileSync(SHARED_SCRIPT, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/index.ts:287
Evidence: execFileSync(SHARED_SCRIPT, args, {