ClawHub
Back to skill

Security audit

Clawvault Memory

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local-memory skill whose persistence is core to its purpose, though users should understand it can save selected conversation facts and lessons automatically across sessions.

Install this only if you want an agent to keep local cross-session memory. Avoid letting it store secrets or sensitive personal details, use 'stop remembering' or 'don't save this' when needed, and review the separate ClawVault plugin before trusting its implementation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Confidence
96% confidence
Finding
The skill description tells the agent to activate not only on explicit memory requests, but also whenever 'a fact is worth keeping,' when something fails, when the user corrects it, or when it finds a better approach. Those triggers are subjective and broad, making it likely the skill will engage during ordinary conversation and silently persist more data than the user expects.

Vague Triggers

Medium
Confidence
98% confidence
Finding
The 'When to activate' list includes broad triggers such as learning any durable fact, uncertainty before stating a fact, command failures, discovering a better approach, and major tasks. In practice this can cause pervasive automatic activation and background storage/search behavior well beyond explicit memory use, increasing privacy and prompt-scope risks.

Session Persistence

Medium
Category
Rogue Agent
Content
- **You discover a better approach**, or a requested capability doesn't exist
- **Before a major task** — review relevant lessons first (`clawvault_search`)

## Write before you respond (durability)

When the user states something worth keeping — a **preference, decision, deadline, fact, or
correction** — save it to ClawVault **before** you write your reply, not after. If the session
Confidence
97% confidence
Finding
The skill instructs the agent to persist user preferences, decisions, facts, and corrections across sessions before responding, creating durable retention by default. Even with some disclosure language later, this design increases the risk of storing sensitive or contextual information without sufficiently explicit, granular consent at the moment of capture.

Persistent Context Injection

Medium
Category
Memory Poisoning
Content
**2. Detect recurrence → promote.** Before saving, `clawvault_search` the pattern-key. If the lesson already exists, it recurred — **promote it**: save a sharpened version with higher `importance` and `supersedes:[oldId]`. Recurring pain earns higher importance.

**3. Graduate proven lessons.** When a lesson keeps mattering, raise its `importance` so it surfaces first in recall. If it's important enough to load *every* session, **suggest to the user** that they add it to their `AGENTS.md` — **do not edit instruction files yourself.** Auto-modifying always-loaded guidance is a prompt-injection risk (an attacker-supplied "lesson" could become permanent instructions); that decision belongs to the user.

**4. Reflect after real work.** When a task completes, log a short reflection:
Confidence
80% confidence
Finding
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

File System Enumeration

Medium
Category
Data Exfiltration
Content
🔴 "unknown tool" → you installed a different ClawVault. See below.

2. Is the database there?
   ls -la ~/.openclaw/memory/clawvault.db
   ✅ want: a file
   🔴 missing → the plugin never initialised
Confidence
60% confidence
Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.