Credential Vault

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:55 AM UTC
• Version: 1.0.0-beta.8

Overview

This credential-vault skill is coherent, but it asks users to install mutable global code that handles secrets and OpenClaw hooks, while documenting unsafe plaintext credential entry.

Review the exact npm package version and source before installing, avoid entering real secrets via --key command arguments, and only use this if you are comfortable granting a plugin access to credential storage plus OpenClaw execution and message/transcript hooks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:15
• Finding: Unpinned Global Installation of a Security-Sensitive npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-20` and `SKILL.md:47-50` **Vulnerability Type**: Unpinned third-party dependency and supply-chain exposure **Risk Level**: High ### Vulnerable Code ```yaml install: - id: openclaw-credential-vault kind: node package: openclaw-credential-vault bins: [openclaw-credential-vault] label: Install Credential Vault plugin (npm) ``` ```markdown ## Install Install the plugin via npm: ```bash npm install -g openclaw-credential-vault ``` ``` ### Technical Analysis The Skill directs users to install `openclaw-credential-vault` globally without specifying an exact version or package integrity digest. Consequently, the installed code is determined by the package registry at installation time and can differ from the version reviewed when the Skill was published. The project contains only `SKILL.md`; it does not include the dependency's implementation. Therefore, the claims concerning encryption, credential injection, output scrubbing, and hook behavior cannot be verified from the audited artifact. A global npm installation can also execute package lifecycle scripts with the privileges of the user running npm. This dependency is especially sensitive because the documentation states that it registers execution and messaging hooks and handles decrypted credentials. Compromise of this dependency would therefore provide access to high-value secrets and trusted Agent execution channels. ### Attack Path 1. An attacker compromises the npm publisher account, package release pipeline, or another component in the package's supply chain. 2. The attacker publishes a malicious release under the same package name. 3. A user follows the Skill's instructions and runs `npm install -g openclaw-credential-vault`. 4. npm resolves and installs the attacker-controlled release because no exact version or integrity value is required. 5. Malicious lifecycle or runtime code executes with the installing user's ...[truncated 784 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to a reviewed, immutable version rather than resolving the latest registry release. 2. Record and verify a cryptographic integrity digest for the distributed package. 3. Verify npm package provenance and require signed, reproducible releases where supported. 4. Audit the exact package archive, including lifecycle scripts, transitive dependencies, hook registration, credential handling, and network behavior. 5. Avoid global installation when possible; use a restricted, project-local installation or isolated environment with least-privilege permissions. 6. Disable npm lifecycle scripts during initial inspection, then enable only scripts demonstrated to be necessary and safe. 7. Include the security-relevant implementation in the reviewed artifact or link the Skill to an immutable source commit rather than a mutable branch. 8. Establish dependency monitoring and an explicit upgrade-review process so newer releases are not automatically trusted. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:62
• Finding: Plaintext Credentials Supplied Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:62-76`, `SKILL.md:95-103`, and `SKILL.md:106-113` **Vulnerability Type**: Plaintext sensitive data exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash # Add a credential (interactive — picks the right injection type) openclaw vault add github --key "ghp_your_token_here" # Add more openclaw vault add stripe --key "sk_live_..." openclaw vault add npm --key "npm_..." ``` ```markdown - `vault add <tool> --key <cred>` — Add a credential (interactive usage selection: API, CLI) - `vault rotate <tool> --key <new>` — Rotate a credential (re-encrypts in place) ``` ```bash # API header injection openclaw vault add stripe --key "sk_live_..." --use api --url "api.stripe.com/*" --yes # CLI env injection openclaw vault add github --key "ghp_..." --use cli --command gh --env GITHUB_TOKEN --yes ``` ### Technical Analysis The documented interface places credentials directly in the command's argument vector through `--key`. Quoting the value prevents ordinary shell word splitting but does not make the secret confidential. Depending on the operating system and local configuration, command-line arguments may be visible through process-inspection interfaces while the command is running. The command can also be retained in interactive shell history, terminal capture, audit systems, debugging output, command telemetry, or synchronized history services. This behavior contradicts the Skill's objective of keeping credentials outside observable Agent and system contexts. Encryption performed after the command starts does not remediate plaintext copies already exposed through command entry and process creation. ### Attack Path 1. A user follows the documented command and places a real API key, token, or password after `--key`. 2. The shell records the complete command in history, or the operating system exposes the argument vector while the process runs. 3. A local ...[truncated 1052 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove support for passing secrets directly through `--key`, or clearly deprecate and reject that form. 2. Read credentials from a dedicated interactive prompt with terminal echo disabled. 3. For automation, accept secrets through a protected file descriptor, secure standard input, or an operating-system credential facility rather than through the argument vector. 4. If file-based input is necessary, require owner-only permissions, avoid predictable temporary files, and securely remove the input after use. 5. Ensure prompts, errors, debug logs, audit records, and telemetry never reproduce the plaintext credential. 6. Update all quick-start, rotation, and non-interactive examples to use the secure input mechanism. 7. Warn existing users to inspect and remove affected shell-history entries, terminal logs, CI logs, and telemetry records, then rotate any credential previously entered through `--key`. 8. Add tests verifying that real credential values do not appear in process arguments, command output, application logs, audit logs, or transcripts. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

## Commands

- `vault init` — Initialize vault and create `~/.openclaw/vault/` directory
- `vault add <tool> --key <cred>` — Add a credential (interactive usage selection: API, CLI)
- `vault list` — Show all stored credentials and status
- `vault show <tool>` — Show credential details and injection config

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.