ClawHub
Back to skill

Security audit

Clawvault Memory

Security checks for vulnerabilities and agentic risk

Overview

This memory skill is mostly coherent, but it enables broad quiet cross-session saving and depends on an unpinned external plugin the artifact does not include.

Review before installing if you are comfortable with an agent keeping local memories across sessions. Consider using it only when you explicitly want persistent memory, avoid saving secrets or personal data, and inspect or pin the required ClawVault plugin before restarting the gateway.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Unpinned and Unreviewable Third-Party Plugin Dependency

Content
View full analysis
```bash > # 1. the plugin — the engine. THIS is the step most people miss > openclaw plugins install clawhub:openclaw-plugin-clawvault > > # 2. this skill — skip it if you are already reading this from an installed copy > openclaw skills install @davidtkeane/clawvault-memory > > openclaw gateway restart > ``` ``` The later installation guidance also states: ```markdown > **Same plugin, either source:** the ClawHub package above and > [github.com/davidtkeane/openclaw-plugin-clawvault](https://github.com/davidtkeane/openclaw-plugin-clawvault) > are the same code. ClawHub is easier — one command, dependency (`typebox`) and prebuilt > `dist/` included, no clone or `npm install`. Use GitHub if you want to read or build the > source yourself. ``` ### Technical Analysis The Skill's essential functionality is not implemented in the audited artifact. Instead, users are instructed to install a remotely hosted executable plugin and restart the OpenClaw gateway to activate it. The installation command does not pin an immutable version or integrity hash, and the referenced plugin source and prebuilt `dist/` file are absent from the audited project. The statement that the ClawHub package and GitHub repository contain the same code is not an integrity control. Without cryptographic verification or reproducible-build validation, reviewers cannot establish that the downloaded executable corresponds to the repository source or to the version originally reviewed. The Skill claims that the plugin makes no network calls and stores data locally, but that claim cannot be verified from the supplied files because the plugin implementation is not included. ### Attack Path 1. An attacker compromises the package publisher account, registry ent ...[truncated 1357 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:71
Finding

Persistent Memory Poisoning Through Untrusted Lessons and Corrections

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description instructs activation for very broad situations such as when a fact is worth keeping, when something fails, when the user corrects the agent, or before major tasks. This can cause the memory workflow to trigger in many normal conversations, increasing the chance of unsolicited persistence of user data and unnecessary tool use without clear user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The 'When to activate' section contains common-language triggers that overlap with routine interaction patterns, including corrections, failures, and learning a useful fact. In a persistence-oriented skill, overly broad activation is risky because it can silently expand collection and retention of conversation data beyond what users reasonably expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The skill directs the agent to save preferences, decisions, deadlines, facts, and corrections to durable local storage before responding, creating systematic session-to-session persistence. Even with local-only storage, this materially increases privacy risk because sensitive or regulated information can be retained by default, especially when combined with the broad activation conditions and mostly silent saving behavior.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
- **You discover a better approach**, or a requested capability doesn't exist
- **Before a major task** — review relevant lessons first (`clawvault_search`)

## Write before you respond (durability)

When the user states something worth keeping — a **preference, decision, deadline, fact, or
correction** — save it to ClawVault **before** you write your reply, not after. If the session

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
**2. Detect recurrence → promote.** Before saving, `clawvault_search` the pattern-key. If the lesson already exists, it recurred — **promote it**: save a sharpened version with higher `importance` and `supersedes:[oldId]`. Recurring pain earns higher importance.

**3. Graduate proven lessons.** When a lesson keeps mattering, raise its `importance` so it surfaces first in recall. If it's important enough to load *every* session, **suggest to the user** that they add it to their `AGENTS.md` — **do not edit instruction files yourself.** Auto-modifying always-loaded guidance is a prompt-injection risk (an attacker-supplied "lesson" could become permanent instructions); that decision belongs to the user.

**4. Reflect after real work.** When a task completes, log a short reflection:

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
🔴 "unknown tool" → you installed a different ClawVault. See below.

2. Is the database there?
   ls -la ~/.openclaw/memory/clawvault.db
   ✅ want: a file
   🔴 missing → the plugin never initialised

Static analysis

No suspicious patterns detected.