ClawHub
Back to skill

Security audit

clawvault

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is transparent about many sensitive actions, but it needs Review because it enables unpinned external code and a lifecycle hook whose source is not included in the published bundle.

Review carefully before installing. Prefer exact pinned versions, inspect the installed hook source locally before enabling it, understand that it can run during OpenClaw lifecycle events, and only use transcript repair or observe compression if you are comfortable with the local transcript and optional API-key data access involved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:12
Finding

Unpinned Third-Party Packages and Unauditable Hook Activation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12 and 39–75
Vulnerability Type: Supply-chain exposure through mutable dependencies and external hook code
Risk Level: High

Vulnerable Code

yaml
install: [{"id":"node","kind":"node","package":"clawvault","bins":["clawvault"],"label":"Install ClawVault CLI (npm)"},{"id":"qmd","kind":"node","package":"github:tobi/qmd","bins":["qmd"],"label":"Install qmd backend (required for query/context workflows)"}]
markdown
**Auditability:** the published ClawHub skill bundle includes `SKILL.md`, `HOOK.md`, and `hooks/clawvault/handler.js` so users can inspect hook behavior before enabling it.

## Install (Canonical)

```bash
npm install -g clawvault
openclaw hooks install clawvault
openclaw hooks enable clawvault

# Verify and reload
openclaw hooks list --verbose
openclaw hooks info clawvault
openclaw hooks check
# restart gateway process

clawhub install clawvault can install skill guidance, but does not replace explicit hook pack installation.

Recommended Safe Install Flow

bash
# 1) Review package metadata before install
npm view clawvault version dist.integrity dist.tarball repository.url

# 2) Install CLI + qmd dependency
npm install -g clawvault@latest
npm install -g github:tobi/qmd

# 3) Install hook pack, but DO NOT enable yet
openclaw hooks install clawvault

# 4) Review hook source locally before enabling
node -e "const fs=require('fs');const p='hooks/clawvault/handler.js';console.log(fs.existsSync(p)?p:'hook file not found in current directory')"
openclaw hooks info clawvault

# 5) Enable only after review
openclaw hooks enable clawvault
openclaw hooks check
text

### Technical Analysis

The skill directs users to globally install the `clawvault` npm package without a fixed version and to install `qmd` directly from a mutable GitHub repository reference. The explicit use of `clawvault@latest` confirms that installation resolves to a release that can change after
...[truncated 2583 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin clawvault to an exact, reviewed version rather than using an unqualified package name or @latest.
  2. Pin qmd to a specific immutable Git commit SHA instead of a mutable GitHub branch or default reference.
  3. Publish a lockfile or equivalent dependency manifest that records exact transitive dependency versions.
  4. Verify package provenance and integrity before installation, and enforce the expected digest rather than merely displaying registry metadata.
  5. Include HOOK.md, hooks/clawvault/handler.js, and every runtime file in the audited skill bundle.
  6. Ensure the hook installed at runtime is byte-for-byte identical to the reviewed hook source.
  7. Separate installation from activation and require explicit user approval after displaying the exact local hook path, version, hash, permissions, and subscribed lifecycle events.
  8. Prefer a user-scoped, isolated installation over global package installation where supported.
  9. Disable npm lifecycle scripts during initial inspection when operationally possible, then permit them only after reviewing the pinned package contents.
  10. Document a safe removal procedure for the hook and globally installed executables.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md
**Auditability:** the published ClawHub skill bundle includes `SKILL.md`, `HOOK.md`, and `hooks/clawvault/handler.js` so users can inspect hook behavior before

Static analysis

No suspicious patterns detected.