Code Pluginsource linked
@taco-trade/web-copilotv2.0.9
OpenClaw channel plugin for Taco web copilot
Community code plugin. Review compatibility and verification before install.openclaw plugins install clawhub:@taco-trade/web-copilotLatest release: v2.0.9Download zip
Capabilities
- Channels
- web-copilot
- configSchema
- Yes
- Executes code
- Yes
- HTTP routes
- 0
- Plugin kind
- channel
- Runtime ID
- web-copilot
- Setup entry
- Yes
Compatibility
- Built With Open Claw Version
- 2026.3.24-beta.2
- Plugin Api Range
- >=2026.3.24-beta.2
- Plugin Sdk Version
- 2026.3.24-beta.2
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The package declares itself as a 'web-copilot' channel and requires an apiToken and userId in its channel config (documented in openclaw.plugin.json). The code only interacts with a configurable backendBaseUrl and the OpenClaw plugin APIs, which is appropriate for a channel plugin.
Instruction Scope
The SKILL.md content shown is the package.json metadata rather than a textual runtime instruction doc, but the included JS files implement a polling client that long-polls the configured taco backend and dispatches inbound updates to the agent and posts replies back — behavior consistent with the plugin description. No instructions ask the agent to read unrelated files or environment variables.
Install Mechanism
There is no install spec (instruction-only install), and no downloads or external installers are used. The code files are included in the package; runtime dependencies appear to be provided by the OpenClaw environment. No risky install URLs or extraction steps are present.
Credentials
The plugin requires only channel config values (apiToken, userId, optional backendBaseUrl) which are declared in openclaw.plugin.json. There are no requested environment variables, system paths, or unrelated credentials.
Persistence & Privilege
The skill is not marked always:true and does not change other skills' configs or request system-wide privileges. It runs as a normal channel plugin that may register a polling loop within the agent runtime (expected for this kind of plugin).
Assessment
This plugin appears to do what it says: it long-polls a Taco backend and routes messages into OpenClaw. Before installing, ensure you trust the backend URL (backendBaseUrl) and only provide an apiToken with the minimum necessary scope. Keep the token secret (store it in the channel config securely), verify the package owner if you expect production use, and consider reviewing the rest of index.js (the truncated portion) in your environment to confirm no unexpected logging or outgoing endpoints beyond the configured backend. Also note the SKILL.md shown is package.json metadata rather than a human-readable runtime guide — if you need clearer runtime behavior guarantees, ask the publisher for explicit instructions or audit logs of network endpoints and token usage.Verification
- Tier
- source linked
- Scope
- artifact only
- Summary
- Validated package structure and linked the release to source metadata.
- Source
- github.com/nada/channel
- Commit
- 9
- Tag
- 9
- Provenance
- No
- Scan status
- clean
Tags
- latest
- 2.0.9