Security audit
ClawVault
Security checks across malware telemetry and agentic risk
Overview
ClawVault is a disclosed local-memory plugin that stores agent-selected memories in a local SQLite database and does not show hidden network, credential, or destructive behavior.
Install only if you want an agent to retain searchable long-term memories locally. Avoid saving secrets or sensitive personal data unless you are comfortable keeping them in the SQLite database, and review or delete ~/.openclaw/memory/clawvault.db when needed.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.