ClawLink is a third-party integration hub for OpenClaw. It is not affiliated with, endorsed by, or part of the OpenClaw project.

This policy covers the ClawLink code published in this repository:

• the ClawHub package clawlink-plugin and its npm mirror @useclawlink/openclaw-plugin (source: packages/openclaw-clawlink/)
• the ClawLink hosted app, dashboard, and API routes at claw-link.dev

Older plugin versions are not patched in place. Please upgrade to the latest minor release before opening a report.

The plugin ships on ClawHub as clawlink-plugin. Each release records the source repository, commit, and tag it was built from. To inspect them:

npx clawhub package inspect clawlink-plugin --json

Cross-check verification.sourceCommit against the GitHub tag for the same version:

git ls-remote https://github.com/ClawLink-HQ/clawlink openclaw-plugin-v<version>

The same plugin is mirrored to npm as @useclawlink/openclaw-plugin with an npm provenance attestation, recorded in the public Sigstore transparency log. The attestation links each tarball on npm to the GitHub Actions run that built it. See .github/workflows/publish-openclaw-plugin.yml for the publish workflow.

To inspect the npm attestation:

npm view @useclawlink/openclaw-plugin --json | jq '.dist.attestations'

You can also see the Provenance section on the npm package page.

Please report vulnerabilities privately — do not open a public GitHub issue.

• Email: hello@claw-link.dev
• Subject line: [security] <short summary>
• Include: affected component, reproduction steps, impact, and any relevant request/account context

We aim to acknowledge reports within 3 business days and provide an initial triage within 7 business days. Fix timelines depend on severity and scope.

In scope:

• the plugin code in packages/openclaw-clawlink/
• authentication, credential storage, tool execution, billing, and hosted connect flows at claw-link.dev
• OAuth callback handling and connection-session lifecycle

Out of scope:

• vulnerabilities in third-party provider APIs that ClawLink integrates with (report those to the provider)
• user-specific misconfiguration, lost API keys, or compromised OpenClaw installs
• denial-of-service via rate-limit exhaustion against claw-link.dev
• social-engineering attacks against end users
• issues in unmaintained or yanked plugin versions

We support coordinated disclosure. If you plan to publish a writeup, please give us a reasonable window to ship a fix and notify affected users. We will credit reporters in release notes on request.

The only legitimate sources for the ClawLink OpenClaw plugin are:

• ClawHub: clawlink-plugin (https://clawhub.ai/packages/clawlink-plugin)
• npm mirror: @useclawlink/openclaw-plugin
• Source: https://github.com/ClawLink-HQ/clawlink
• Website: https://claw-link.dev

Anything pointing at a different package name, domain, or repository is not the official ClawLink flow. Please report suspected clones to hello@claw-link.dev.