registry / openclaw-slack-buttons-hotfix / 0.1.2

openclaw-slack-buttons-hotfix@0.1.2

Hotfix channel plugin: makes OpenClaw presentation buttons render as real Slack Block Kit instead of a bullet-text list (upstream bug openclaw/openclaw#95440). Wraps the official @openclaw/slack plugin and bridges the missing renderPresentation/presentati

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. An explicitly enabled OpenClaw channel extension can supersede the Slack channel and load the locally installed official Slack plugin. No confirmed exfiltration, destructive action, or install-time mutation is present.

Static reason

No blocking static signals were detected.

Trigger

User installs/enables the OpenClaw plugin and routes Slack through it.

Impact

Changes Slack presentation-button rendering within the OpenClaw runtime.

Mechanism

Slack outbound-adapter capability bridge with local peer-plugin resolution.

Rationale

Source inspection shows a user-enabled OpenClaw Slack-channel override that dynamically resolves the official peer plugin and patches its outbound presentation facade. It has no lifecycle execution or concrete malicious behavior, but its agent-extension takeover scope warrants a warning under the extension-lifecycle policy.

Evidence

package.jsonindex.jspatched-plugin.jsresolve-slack.jsruntime.jssecrets.jsopenclaw.plugin.json

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

openclaw-slack-buttons-hotfix@0.1.2

AI Security Review

Decision evidence

Source & flagged code

Findings