Caveat verdict
OrchardOS
orchard
OrchardOS is an OpenClaw plugin providing a SQLite-backed task board with a queue runner and REST API; all operations are local database and agent dispatch operations within the OpenClaw platform.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (4)
Possible hardcoded credential
docs/ux-brief.md · code · TOKEN="<your-gateway-token>
HTTP request to bare IP address — common in malicious payloads
docs/ux-brief.md · code · http://127.0.0.1
Uses exec() — may execute shell commands
src/db/schema.ts · prose · downgraded · exec(
Accesses sensitive environment variables
src/index.ts · prose · downgraded · process.env.GEMINI_API_KEY
Permissions & capabilities
No declared permissions — minimal attack surface.
Is this flag fair?
Thanks — recorded.