Logs: 

$ openclaw plugins install xx
  Downloading xx...
  (node: 1552) [DEP0190] DeprecationWarning: Passing args to a child process with shell option
   true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
  (Use 'node --trace-deprecation...' to show where the warning was created)
  npm pack failed: ': \Progran' +<garbled binary output>

evidence:
Root cause analysis:
  The issue is in src/process/exec.ts — the runCommandWithTimeout function, called from src/infra/install-source-utils.ts:218 during npm pack.
  The call chain is:

  installPluginFromNpmSpec (src/plugins/install.ts:497)
    → installFromNpmSpecArchive (src/infra/npm-pack-install.ts:96)
      → packNpmSpecToArchive (src/infra/install-source-utils.ts:218)
        → runCommandWithTimeout(["npm", "pack", spec, ...], { cwd: tmpDir })
          → src/process/exec.ts:225-242

  In runCommandWithTimeout (line 225-242), resolveNpmArgvForWindows resolves ["npm", "pack", ...] to:
  ["C:\Program Files\nodejs\node.exe",
   "C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js",
   "pack", spec, "--ignore-scripts", "--json"]
  These are passed to spawn():
  spawn(
    "C:\\Program Files\\nodejs\\node.exe",
    ["C:\\Program Files\\nodejs\\...\\npm-cli.js", "pack", spec, ...],
    { cwd, windowsVerbatimArguments: undefined /* NOT set */ }
  );
  When windowsVerbatimArguments is not set, Node.js applies its own argument escaping for CreateProcessW. On certain Node versions, this escaping can mishandle
   Windows paths that contain both backslashes and spaces, causing the command line to be garbled.
  There is also a secondary issue: if resolveNpmArgvForWindows returns null (e.g. Node installed via nvm-windows / volta / fnm where npm-cli.js is not at the  
  expected location), resolveCommand("npm") returns bare "npm" (since "npm" was removed from the cmdCommands list in commit a1a8ec687), so spawn("npm", ...) is
   called without shell or cmd wrapper, which causes EINVAL on Node 18.20.2+.