openclaw.security.json

{
  "$schema": "https://openclaw.ai/schemas/plugin-security.json",
  "version": "1.0",
  "plugin": "@blockrun/xclawrouter",
  "description": "Smart LLM router with x402 micropayments - legitimately requires wallet key for payment signing",
  "expectedBehaviors": [
    {
      "type": "env-access",
      "variable": "BLOCKRUN_WALLET_KEY",
      "purpose": "x402 payment signing",
      "justification": "XClawRouter uses this wallet key to sign USDC payment transactions on Base L2. The key is used LOCALLY for cryptographic signing and is NEVER transmitted over the network. This is required for x402 protocol compliance.",
      "dataFlow": "local-only",
      "networkTransmission": false
    }
  ],
  "securityNotes": [
    "The wallet key is used solely for EIP-712 signature generation",
    "Signatures are transmitted, not the private key itself",
    "Users fund their own wallets - XClawRouter does not custody funds",
    "All payment signing happens client-side in the proxy",
    "Source code is MIT licensed and fully auditable"
  ],
  "references": [
    "https://x402.org - x402 payment protocol specification",
    "https://eips.ethereum.org/EIPS/eip-712 - EIP-712 typed data signing",
    "https://blockrun.ai/docs - BlockRun API documentation",
    "https://github.com/BlockRunAI/XClawRouter - Source code (MIT licensed)"
  ]
}