registry / @inline-openclaw/inline / 0.0.71
@inline-openclaw/inline@0.0.71
⚠ Under reviewOpenClaw channel plugin for interacting with an OpenClaw agent via **Inline**.
Static Scan Results
scanned 25d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetwork
HighEntropyStringsUrlStrings
Source & flagged code
3 flaggeddist/runtime-register-api.jsView file
793}
L794: fork() {
L795: this.stack.push({ chunks: this.chunks, buf: this.buf });
High
Child Process
Package source references child process execution.
dist/runtime-register-api.jsView on unpkg · L793dist/channel-plugin-api.jsView file
70Cross-file remote execution chain: dist/channel-plugin-api.js spawns dist/approval-handler.runtime.js; helper contains network access plus dynamic code execution.
L70:
L71: // ../../node_modules/.bun/@protobuf-ts+runtime@2.11.1/node_modules/@protobuf-[redacted].js
L72: var require_base64 = __commonJS(function(exports) {
...
L428: if (!bi)
L429: throw new Error("BigInt unavailable, see https://github.com/timostamm/protobuf-ts/blob/v1.0.8/MANUAL.md#bigint-support");
L430: }
...
L793: }
L794: fork() {
L795: this.stack.push({ chunks: this.chunks, buf: this.buf });
...
L2456: internalJsonWrite(message, options) {
L2457: return this.refJsonWriter.write(message, options);
L2458: }
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/channel-plugin-api.jsFindings
3 High2 Medium5 Low
HighChild Processdist/runtime-register-api.js
HighCross File Remote Execution Contextdist/channel-plugin-api.js
HighSemantic Analysis Limiteddist/approval-handler.runtime.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowEval
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @inline-openclaw/inline@0.0.71.
See all versions of @inline-openclaw/inline for other recorded verdicts.
- Review the evidence and your use of @inline-openclaw/inline@0.0.71 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.