ClawHub
Back to skill

Security audit

ClawVault

Security checks across malware telemetry and agentic risk

Overview

ClawVault is a disclosed local memory and recovery hook whose automatic prompt/session handling is sensitive but aligned with its stated purpose after the user enables it.

Install this only if you want persistent agent memory that can automatically reuse prior vault and session context. Review the hook before enabling it, choose CLAWVAULT_PATH deliberately, avoid storing secrets or unrelated private history in the vault, and leave GEMINI_API_KEY unset unless sending transcript-derived observation content to Gemini is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The hook documentation states that the session-start flow extracts the user's initial prompt and passes it to an external CLI command (`clawvault context "<prompt>" ...`) but does not clearly warn users that their prompt content is being transmitted for external processing. Initial prompts often contain sensitive instructions, secrets, incident details, or personal data, so undisclosed forwarding to another tool creates a meaningful privacy and data-handling risk. The skill context makes this more dangerous because session-start behavior is automatic and happens before a user can review or consent for each invocation.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The startup behavior runs `clawvault recover --clear`, which implies recovery state is cleared automatically, but the documentation does not prominently warn users about this destructive state-changing action. Undisclosed clearing can erase forensic or recovery context, hinder troubleshooting, or remove data a user expected to persist. This is more dangerous in this skill because it is tied to automatic gateway startup, so the action may occur repeatedly without direct user awareness.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
hooks/clawvault/handler.js:11