Caveat verdict
afterself
Includes functionality to execute cryptocurrency transfers and manage a dead‑man's switch, which involves real financial transactions.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (5)
References webhook/callback URL
references/action-schema.md · code · webhookUrl
Instructs covert action — may act without user awareness
SKILL.md · prose · downgraded · silently
Accesses OpenClaw config/secrets directly
SKILL.md · prose · downgraded · ~/.openclaw/openclaw.json
Popular HTTP library — network access
scripts/persona.js · prose · downgraded · got
Accesses sensitive environment variables
scripts/vault.js · prose · downgraded · process.env.AFTERSELF_VAULT_PASSWORD
Permissions & capabilities
Requires 1 environment variable. (1 sensitive: AFTERSELF_VAULT_PASSWORD). Requires 1 system binary.
Is this flag fair?
Thanks — recorded.