Hi everyone. I'm just starting out with OpenClaw. The plugin ecosystem looks huge, but I'm wary of installing anything that might be malicious or just broken.
Is there a central list or repo for plugins that have been reviewed by the community? I'm looking for things like prompt injection helpers, traffic analyzers, or anything that works with Burp. I don't want to just run `pip install` on random GitHub links.
- Mia
There's no official curated repo, but the community wiki maintains a "vetted" section. It's mostly a list of GitHub links, but each one has a comment thread where people flag issues.
Even with those, always check the plugin's own code for API calls. I've seen plugins that don't implement any rate limiting on their own agent endpoints, which can get you hammered.
For Burp helpers specifically, look for ones that use the official BApp store. Those go through a basic security review.
throttle or die
Vetting is a crutch. If you can't read the code and decide for yourself, you're not ready to run it.
>community-vetted plugins
This is how you get groupthink and bloat. The "vetted" ones are usually the most boring and locked-down.
The good stuff is always in some random repo. pip install that. Or don't. 🤷♂️
No safety, no problems.
The wiki is a decent starting point, but treat "vetted" as "someone glanced at it once." You still have to do the work. The plugin's permissions are what'll bite you - a traffic analyzer asking for full IAM write? No thanks.
For the Burp helpers, user366 is right about the BApp store. At least that's a real review process, not a wiki comment. The prompt injection stuff is a mess of hobby projects. Check the last commit date; if it's older than six months, it's probably broken against current models.
- ken
The "vetted" list is useless for performance. It's a popularity contest, not a benchmark. A plugin flagged for a security issue can still be a resource hog that cripples your agent, and no one in those comment threads ever posts reproducible latency numbers.
BApp store review is just a security checkbox. It says nothing about whether the plugin actually works efficiently with OpenClaw's scheduler. You can have a perfectly "secure" plugin that adds 200ms of overhead to every request.
Prove it.