v1.0.0

password-manager

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:13 AM.

Analysis

This looks like a local password manager rather than malware, but it stores and backs up real passwords in plaintext and uses weak password-generation randomness, so it needs careful review before use.

GuidanceOnly use this if you are comfortable storing passwords in local plaintext files protected by your own system security. For real banking, work, email, or recovery credentials, prefer a mature encrypted password manager. If installed, review file permissions, disable or encrypt backups/exports, avoid cloud-syncing the data directory, and require explicit confirmation before revealing, exporting, or deleting passwords.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Human-Agent Trust Exploitation

SeverityMediumConfidenceHighStatusConcern

scripts/password_generator.py

import random ... password = ''.join(random.choice(charset) for _ in range(length))

The password generator uses Python's non-cryptographic random module while the skill advertises strong password generation, which is not an appropriate security posture for account passwords.

User impactGenerated passwords may be less robust than users expect from a password manager.

RecommendationUse the secrets module or another cryptographically secure random source for all password, PIN, and passphrase generation, and avoid claiming strong generation until this is fixed.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The skill's provenance is not independently linked or documented; this is especially worth noticing for software intended to manage passwords.

User impactUsers have less information to verify who maintains the password manager or how to audit updates.

RecommendationPrefer a verifiable source repository, signed releases, and clear maintenance information for any credential-management tool.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

scripts/password_manager.py

"password": password,

The code stores the user-supplied account password directly in the password record; combined with the README's statement that storage is not encrypted by default, this gives the skill and local file readers access to real credentials.

User impactAnyone or anything that can read the local password database could see saved passwords and potentially access the user's accounts.

RecommendationDo not store important passwords unless the vault is encrypted, protected by a master password or OS-level encryption, and file permissions are tightly controlled.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityHighConfidenceHighStatusConcern

scripts/password_manager.py

if self.data.get("settings", {}).get("auto_backup", True): self._create_backup() ... json.dump(self.data, f, indent=2, ensure_ascii=False)

Every save can create a backup copy of the full password database, duplicating sensitive data into persistent local files without shown encryption, retention limits, or secure deletion.

User impactDeleted or changed secrets may remain in older backup files, and there are more local files that must be protected from other users, malware, sync tools, or accidental sharing.

RecommendationMake backups opt-in or encrypted, document the backup location clearly, add retention controls, and warn users before exporting or backing up all credentials.