The project is experimental. Security fixes are applied to the latest commit on the default branch.

Use GitHub's private vulnerability reporting for this repository when available. Do not include secrets, access tokens, private keys, personal data, or production configuration in a public issue.

Include:

• affected commit or version;
• reproduction steps using non-sensitive test data;
• expected and observed behavior;
• impact assessment;
• a suggested mitigation, when known.

This plugin coordinates tools that can modify source checkouts. Its safety depends on the permissions and configuration of OpenClaw, the implementation orchestrator, model providers, sandbox, and optional adapters.

Operators should:

• run with the least privileges required;
• use disposable or backed-up checkouts for initial testing;
• review sandbox and protected-path policies;
• keep notifications and external services disabled until configured;
• store credentials outside the repository;
• inspect generated plans before handoff;
• require explicit final validation before closing a cycle.

The repository must not contain operator-specific network addresses, credentials, runtime state, or local filesystem paths. CI runs npm run audit:public to detect common leaks.