Security audit

辉火云管家密码管理(Vault)

Security checks across malware telemetry and agentic risk

Overview

This is a real Vault password-management skill, but it also grants broad secret access and Vault operator controls that users should review carefully before installing.

Install only in an environment where the Vault token is least-privileged and audited. Review whether this skill should be allowed to list all shared secrets, retrieve raw fields, delete entries, create Vault users, or seal/unseal the Vault service; consider removing operator commands and avoiding plain VAULT_TOKEN storage in openclaw.json before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill is presented as a password-management assistant, but it also exposes Vault administrative operations such as sealing and unsealing the service. Mixing secret access with infrastructure control expands the blast radius substantially: a user invoking a credential task could be induced to perform service-disruptive or privileged admin actions unrelated to the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The documented workflow includes creating Vault userpass accounts for colleagues, which is a privileged identity-management function not disclosed in the top-level skill description. Hidden account-provisioning capability increases the risk of unauthorized persistence or privilege expansion because users may invoke the skill expecting only secret lookup and sharing behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Seal/unseal are powerful service-administration operations and are not necessary for ordinary password-management tasks. Exposing them in a broadly triggerable conversational skill creates a direct path to denial of service or misuse of highly sensitive recovery material such as unseal keys.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The helper script advertises a Vault container restart capability unrelated to the skill's stated password-management purpose. This extends the skill from secret handling into infrastructure control, enabling service disruption and increasing the chance that routine secret operations become a vehicle for administrative misuse.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger list includes broad terms such as 'vault' and '密钥', which can cause the skill to activate in conversations that are not clearly requesting secret operations. Because this skill has access to sensitive credentials and admin-adjacent functions, accidental invocation materially increases the chance of unintended secret access or destructive actions.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The intent-recognition table maps common everyday phrases directly to sensitive Vault operations without clear scope checks. In a secret-management context, this can lead to overbroad execution of listing, retrieval, writing, or account-sharing commands from ambiguous natural language.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared # 列出子分类 source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/ai source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/servers source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites
Confidence: 95% confidence
Finding: This line documents loading an environment file and enumerating secret paths under `secret/shared`, which is credential-access functionality. In the context of a conversational skill, exposing direct commands to list sensitive secret namespaces increases the chance of unauthorized discovery of available credentials and targets.

Credential Access

High

Category: Privilege Escalation
Content: # 列出子分类 source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/ai source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/servers source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud
Confidence: 95% confidence
Finding: This command continues broad enumeration of secret categories after sourcing a privileged environment file. Even without retrieving values, inventory disclosure reveals what systems, services, or providers the organization uses, which aids follow-on credential targeting and lateral movement.

Credential Access

High

Category: Privilege Escalation
Content: # 列出子分类 source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/ai source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/servers source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment
Confidence: 95% confidence
Finding: The skill provides another privileged path-enumeration command for shared secret storage. Repeated examples of direct enumeration normalize credential discovery as a default action, which is dangerous in an agent setting where prompts can be ambiguous or adversarially framed.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/ai source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/servers source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/publish
Confidence: 95% confidence
Finding: This line exposes continued enumeration of sensitive Vault namespaces through a sourced environment file. The context makes it more dangerous because the skill explicitly manages many categories of production secrets, so path discovery meaningfully increases operational and attack intelligence.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/servers source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/publish source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/other
Confidence: 95% confidence
Finding: The documented command lists additional shared secret categories, contributing to a comprehensive inventory of credential-bearing systems. In a secret-management skill, inventory exposure is itself sensitive because it reveals high-value services and possible credential types even before secret values are read.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/channels source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/publish source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/other
Confidence: 95% confidence
Finding: This line further demonstrates privileged listing of secret namespaces using environment-loaded access. The danger is amplified by the skill's broad path structure, which includes cloud, payment, publishing, and other high-impact secrets that should not be discoverable by default.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/test-sites source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/publish source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/other # 读取某个密码（显示所有字段）
Confidence: 95% confidence
Finding: The command sequence continues secret namespace enumeration, making the skill capable of mapping out the organization's credential layout. Such discovery facilitates social engineering, targeted retrieval attempts, and abuse of any downstream command that accepts a path parameter.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/cloud source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/payment source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/publish source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/other # 读取某个密码（显示所有字段） source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv get secret/shared/ai/deepseek
Confidence: 97% confidence
Finding: This line documents direct retrieval of a secret entry after sourcing the Vault environment file. In context, that is a core credential-access capability and is dangerous because the skill includes paths to production secrets across multiple services, making unauthorized invocation potentially expose live credentials.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv list secret/shared/other # 读取某个密码（显示所有字段） source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv get secret/shared/ai/deepseek # 只读取某个字段 source ~/.openclaw/service-env/ai.openclaw.vault.env && vault kv get -field=api_key secret/shared/ai/gemini
Confidence: 97% confidence
Finding: This command retrieves a specific field from a secret, demonstrating precise extraction of live credentials such as API keys. Field-level access can make exfiltration easier and less noticeable because it supports targeted harvesting of just the valuable secret material rather than whole records.

Credential Access

High

Category: Privilege Escalation
Content: source ~/.openclaw/service-env/ai.openclaw.vault.env && vault status # 封锁 source ~/.openclaw/service-env/ai.openclaw.vault.env && vault operator seal # 解封（需要 unseal key） source ~/.openclaw/service-env/ai.openclaw.vault.env && vault operator unseal <unseal_key>
Confidence: 93% confidence
Finding: This line documents `vault operator unseal <unseal_key>` after loading the environment, which involves highly sensitive recovery material and privileged service control. In a conversational skill, requesting or handling unseal keys is especially dangerous because it can expose key shares and enable unauthorized restoration or manipulation of the Vault service.

VirusTotal

59/59 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/resolver.mjs:87
Evidence: const result = spawnSync(vaultBin, ["kv", "get", "-field=value", `secret/${id}`], {