Two permission-related flaws in the @axonflow/openclaw plugin versions 1.3.2 and below allowed local users on the same host to read registration credentials and cache data due to overly permissive directory and credential file modes. The plugin created configuration and cache directories with default permissions (often 0755), making sensitive data traversable by other users. Additionally, the plugin loaded credential files without verifying they were set to restrictive 0600 permissions, potentially exposing credentials if files were copied or restored with incorrect modes. The issue is fixed in version 2.0.0, which enforces 0700 directory permissions on every invocation and refuses to load credential files with non-0600 modes.