registry / @inline-openclaw/inline / 0.0.58
@inline-openclaw/inline@0.0.58
⚠ Under reviewOpenClaw channel plugin for interacting with an OpenClaw agent via **Inline**.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/runtime-register-api.jsView file
773}
L774: fork() {
L775: this.stack.push({ chunks: this.chunks, buf: this.buf });
High
Child Process
Package source references child process execution.
dist/runtime-register-api.jsView on unpkg · L773dist/channel-plugin-api.jsView file
50Cross-file remote execution chain: dist/channel-plugin-api.js spawns dist/approval-handler.runtime.js; helper contains network access plus dynamic code execution.
L50:
L51: // ../node_modules/.bun/@protobuf-ts+runtime@2.11.1/node_modules/@protobuf-[redacted].js
L52: var require_base64 = __commonJS((exports) => {
...
L408: if (!bi)
L409: throw new Error("BigInt unavailable, see https://github.com/timostamm/protobuf-ts/blob/v1.0.8/MANUAL.md#bigint-support");
L410: }
...
L773: }
L774: fork() {
L775: this.stack.push({ chunks: this.chunks, buf: this.buf });
...
L2436: internalJsonWrite(message, options) {
L2437: return this.refJsonWriter.write(message, options);
L2438: }
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/channel-plugin-api.jsFindings
3 High2 Medium5 Low
HighChild Processdist/runtime-register-api.js
HighCross File Remote Execution Contextdist/channel-plugin-api.js
HighSemantic Analysis Limiteddist/channel-plugin-api.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @inline-openclaw/inline@0.0.58.
See all versions of @inline-openclaw/inline for other recorded verdicts.
- Review the evidence and your use of @inline-openclaw/inline@0.0.58 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.