Code PluginExecutes codesource-linked

Subscription Auth

marxbiotech-subscription-auth

Community code plugin. Review compatibility and verification before install.

marxbiotech-subscription-auth · runtime id marxbiotech-subscription-auth

Install

openclaw plugins install clawhub:marxbiotech-subscription-auth

Latest Release

Version 1.0.0

Download zip

Compatibility

{
  "builtWithOpenClawVersion": "1.0.0",
  "pluginApiRange": ">=1.0.0"
}

Capabilities

{
  "bundledSkills": [],
  "capabilityTags": [
    "executes-code"
  ],
  "channels": [],
  "commandNames": [],
  "configSchema": true,
  "configUiHints": false,
  "executesCode": true,
  "hooks": [],
  "httpRouteCount": 0,
  "materializesDependencies": false,
  "providers": [],
  "runtimeId": "marxbiotech-subscription-auth",
  "serviceNames": [],
  "setupEntry": false,
  "toolNames": []
}

Security Scan

VirusTotal

Benign

View report →

OpenClaw

Benign

medium confidence

✓

Purpose & Capability

Name/description align with the implementation: provides /claude_auth, /openai_auth, /openai_callback commands, performs PKCE/OAuth flow for OpenAI and accepts a Claude setup-token, and writes the resulting credentials to the agent auth store.

ℹ

Instruction Scope

Commands read and write local OpenClaw files (auth-profiles.json, openclaw.json) and temporarily store PKCE state in /tmp; they also call auth.openai.com to exchange tokens. This is within the plugin's scope but means you'll be pasting auth codes/tokens and the plugin will update your agent config and default model.

✓

Install Mechanism

No install/spec downloads; code is included in the plugin bundle. No external installers or archived downloads are used.

Credentials

The plugin doesn't request env vars, which is appropriate, but it writes OAuth/access tokens into auth-profiles.json under OPENCLAW_HOME (defaults to ~/.openclaw). The source comment notes that auth-profiles.json is 'auto-synced to R2' — if your OpenClaw installation synchronizes that directory to remote object storage, these credentials could be exposed. Confirm how auth-profiles.json is stored/synced and whether it's encrypted/ACL-protected before use.

ℹ

Persistence & Privilege

always is false and the plugin registers commands that require user invocation/auth. It modifies only OpenClaw-specific files (auth-profiles.json and openclaw.json) to add models and change default model. That behavior is expected for an auth helper but may change agent behavior (switch default model).

Assessment

This plugin appears to do exactly what it says: it helps you sign into Claude and OpenAI and stores the resulting tokens in your OpenClaw agent files. Before installing or using it, verify how your OpenClaw home directory is stored and synchronized: auth-profiles.json will contain access and refresh tokens, and the code's comment warns it may be auto-synced to R2. If your agent directory is synced to remote storage (or backed up without encryption), treat these credentials as potentially exposed. Recommendations: (1) Confirm OPENCLAW_HOME location and change it if you prefer a separate secure path, (2) inspect auth-profiles.json after running the commands and set strict filesystem permissions, (3) confirm whether OpenClaw auto-sync or backups will copy that file off-host and whether that storage is secure, (4) consider deleting the plugin or the stored credentials after completing setup if you don't want long-lived tokens on disk, and (5) only paste redirect URLs or setup-tokens you obtained yourself—these URLs contain authorization codes that grant access.

✗

index.ts:16

Environment variable access combined with network send.

index.ts:1

File read combined with network send (possible exfiltration).

Patterns worth reviewing

These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Verification

{
  "hasProvenance": false,
  "scanStatus": "clean",
  "scope": "artifact-only",
  "sourceCommit": "172ec47851ae8a6516032204dce3182fc800e077",
  "sourceRepo": "marxbiotech/moltbot-app",
  "sourceTag": "172ec47851ae8a6516032204dce3182fc800e077",
  "summary": "Validated package structure and linked the release to source metadata.",
  "tier": "source-linked"
}