Archon Vault

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:19 AM UTC
• Version: 0.1.0

Overview

The skill does what it says, but it handles wallet recovery secrets and broad backups with unsafe scripting practices that deserve careful review before installation.

Review and harden this before using it with real identities or backups. Pin or vendor `@didcid/keymaster`, avoid putting mnemonics on the command line, create private temporary directories with automatic cleanup, fail closed on backup exclusions, validate ZIP contents before extraction, and only run it in an account/environment scoped to the exact vault and files you intend to protect.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T08 · Insecure Dependencies

Error

• Location: scripts/backup/backup-to-vault.sh:43

Finding

Unpinned npm Package Is Downloaded and Executed During Sensitive Operations

Content

View full analysis

/dev/null npx @didcid/keymaster recover-wallet-did > /dev/null npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" ``` ### Technical Analysis The scripts execute `@didcid/keymaster` through `npx` without specifying an exact package version. The project also contains no reviewed lockfile that constrains the package and its transitive dependencies. Depending on the local npm state, `npx` may download and execute the package version currently resolved by the configured registry. Consequently, the code that runs during backup, restoration, wallet reconstruction, and vault management can change after this project has been audited. These invocations occur while highly sensitive values and resources are available, including: - `ARCHON_PASSPHRASE` - `ARCHON_WALLET_PATH` - The disaster-recovery mnemonic - Workspace and OpenClaw configuration archives - Decrypted vault items - Vault membership and access-control operations A compromised package release, registry account, registry configuration, or dependency could therefore execute arbitrary code with the invoking user's permissions. ### Attack Path 1. An attacker compromises the `@didcid/keymaster` package, one of its dependencies, its publisher account, or the npm registry resolution path. 2. The attacker publishes or causes resolution to a modified package version. 3. ...[truncated 934 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/backup-to-vault.sh:39

Finding

Predictable Plaintext Backup Archives Are Written to Shared Temporary Storage

Content

View full analysis

/dev/null || \ zip -q -r workspace.zip "$WORKSPACE_DIR" npx @didcid/keymaster add-vault-item backup /tmp/workspace.zip echo "✓ workspace.zip ($(du -h workspace.zip | cut -f1))" # Backup config (excludes sessions, cache, logs per patterns) echo "Backing up config..." cd ~/.openclaw rm -f /tmp/config.zip zip -q -r /tmp/config.zip . \ -x 'agents/*/sessions/*' \ -x 'agents/*/cache/*' \ -x 'logs/*' \ -x '*.log' \ -x 'browser/*' \ -x 'media/*' \ -x 'canvas/*' npx @didcid/keymaster add-vault-item backup /tmp/config.zip ``` ### Technical Analysis The script creates archives using fixed paths, `/tmp/workspace.zip` and `/tmp/config.zip`. It does not create a private temporary directory, set a restrictive `umask`, perform exclusive file creation, reject symbolic links, or remove the archives automatically after upload. On a multi-user system, predictable names in a shared temporary directory create opportunities for local races and data disclosure. A local attacker may attempt to pre-create or replace one of the paths, monitor it while the archive is being generated, or read the resulting archive when permissions derived from the user's current `umask` allow access. The workspace archive also has an unsafe fail-open fallback. If the exclusion-aware `zip` command fails for any reason, the second command archives the entire workspace without applying `.backup-ignore`. This can silently include files that the user explicitly intended to exclude. Both archives remain on disk after upload, extending the exposure period for potentially sensitive configuration, credentials, conversation state, and workspace files. ...[truncated 1200 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/disaster-recovery.sh:12

Finding

Wallet Recovery Mnemonic Is Exposed Through Command-Line Arguments

Content

View full analysis

/dev/null ``` ### Technical Analysis The script requires the 12-word wallet mnemonic as its first positional command-line argument. This creates two separate exposure points: 1. The user's interactive shell may retain the complete invocation in command history. 2. The mnemonic is passed to the `npx` child process as an argument and may be visible through operating-system process inspection while the command is running. Redirecting standard output to `/dev/null` does not protect process arguments. The mnemonic is the root recovery secret described by the project as the master key. Possession of it may allow an attacker to reconstruct the wallet and recover aliases and vault access. The shell variable remains populated for the rest of the script unless explicitly cleared. ### Attack Path 1. The user follows the documented usage and runs the script with the mnemonic on the command line. 2. The shell records the complete command in history, or a lo ...[truncated 1012 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/backup/restore-from-vault.sh:58

Finding

Vault Archives Are Extracted Without Path, Link, or Resource Validation

Content

View full analysis

/dev/null | jq -e '.["workspace.zip"]' >/dev/null 2>&1; then echo "Downloading workspace.zip..." npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" echo "Extracting workspace..." unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace" rm "$RESTORE_DIR/workspace.zip" echo "✅ Workspace restored to $RESTORE_DIR/workspace/" else echo "⚠️ workspace.zip not found in vault" fi # Restore config if npx @didcid/keymaster list-vault-items backup 2>/dev/null | jq -e '.["config.zip"]' >/dev/null 2>&1; then echo "Downloading config.zip..." npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip" echo "Extracting config..." unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw" rm "$RESTORE_DIR/config.zip" echo "✅ Config restored to $RESTORE_DIR/openclaw/" fi ``` Equivalent unvalidated extraction occurs in `scripts/backup/disaster-recovery.sh`: ```bash npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip" unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace" ``` ### Technical Analysis The scripts download ZIP archives from a vault and immediately extract them with `unzip`. They do not validate: - Absolute archive paths - Parent-directory components such as `../` - Symbolic links or link targets - Special files - Duplicate or conflicting entries - Total expanded size - Compression ratio - File count - A trusted signature or manifest This is an archive-extraction trust-boundary issue. Although the intended backup is produced by the same user, the project supports multi-party vault members ...[truncated 1721 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/backup/verify-backup.sh:29

Finding

Decrypted Backup Verification Files Persist in Predictable Temporary Storage

Content

View full analysis

&1; then echo " ✗ FAILED: Could not retrieve $item_name from vault" ERRORS=$((ERRORS + 1)) return 1 fi # Check file exists and has size if [ ! -f "$VERIFY_DIR/$item_name" ]; then echo " ✗ FAILED: $item_name not found after retrieval" ERRORS=$((ERRORS + 1)) return 1 fi local size=$(du -h "$VERIFY_DIR/$item_name" | cut -f1) echo " Retrieved: $size" ``` The files are retained after completion: ```bash if [ $ERRORS -eq 0 ]; then echo "✓ All backups verified successfully" echo "" echo "Your backups are recoverable. You can restore from:" echo " - workspace.zip ($VERIFY_DIR/workspace.zip)" echo " - config.zip ($VERIFY_DIR/config.zip)" echo " - hexmem.db ($VERIFY_DIR/hexmem.db)" else echo "✗ $ERRORS backup(s) failed verification" echo "" echo "ACTION REQUIRED: Re-run backup-to-vault.sh to fix failed backups" fi echo "" echo "Cleanup: rm -rf $VERIFY_DIR" ``` ### Technical Analysis The verification script writes complete decrypted copies of the backup items into a directory with a predictable process-ID-based name. It uses ordinary `mkdir`, inherits the current `umask`, and does not register an automatic cleanup trap. Instead of deleting the files after integrity testing, the script merely prints a cleanup command. The workspace archive, configuration archive, and memory database can therefore remain in `/tmp` indefinitely after successful verification, ...[truncated 1311 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (56)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

./scripts/backup/verify-backup.sh <backup-did>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup/backup-to-vault.sh (reported line 49)May include surrounding context.

sh

# Backup config (excludes sessions, cache, logs per patterns)
echo "Backing up config..."
cd ~/.openclaw
rm -f /tmp/config.zip
zip -q -r /tmp/config.zip . \
  -x 'agents/*/sessions/*' \
  -x 'agents/*/cache/*' \

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup/disaster-recovery.sh (reported line 103)May include surrounding context.

sh

npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    echo "Extracting workspace..."
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored to $RESTORE_DIR/workspace/"
else
    echo "⚠️  workspace.zip not found in vault"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup/restore-from-vault.sh (reported line 64)May include surrounding context.

sh

npx @didcid/keymaster get-vault-item backup workspace.zip "$RESTORE_DIR/workspace.zip"
    echo "Extracting workspace..."
    unzip -q "$RESTORE_DIR/workspace.zip" -d "$RESTORE_DIR/workspace"
    rm "$RESTORE_DIR/workspace.zip"
    echo "✅ Workspace restored to $RESTORE_DIR/workspace/"
else
    echo "⚠️  workspace.zip not found in vault"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup/disaster-recovery.sh (reported line 114)May include surrounding context.

sh

npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    echo "Extracting config..."
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored to $RESTORE_DIR/openclaw/"
else
    echo "⚠️  config.zip not found in vault"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/backup/restore-from-vault.sh (reported line 77)May include surrounding context.

sh

npx @didcid/keymaster get-vault-item backup config.zip "$RESTORE_DIR/config.zip"
    echo "Extracting config..."
    unzip -q "$RESTORE_DIR/config.zip" -d "$RESTORE_DIR/openclaw"
    rm "$RESTORE_DIR/config.zip"
    echo "✅ Config restored to $RESTORE_DIR/openclaw/"
else
    echo "⚠️  config.zip not found in vault"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## Features

- **Vault Management** — Create vaults, manage items and members
- **Multi-Party Access** — Share vaults with other DIDs
- **Encrypted Backups** — Backup workspace/config to your vault
- **Disaster Recovery** — Restore everything from your 12-word mnemonic

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The README instructs users to run npx @didcid/keymaster without pinning a specific version. This allows execution of whatever package version is current at runtime, creating a supply-chain risk if a malicious or compromised update is published. In a security-sensitive skill involving identity, vault access, and recovery operations, that risk is more dangerous because the invoked tool may handle credentials or secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises backup and restore operations but does not warn that restore may overwrite local files or that backup/restore may transfer large amounts of sensitive data. Users may invoke these commands without understanding destructive effects, causing data loss or unintended exposure of workspace/config contents. Given this skill explicitly handles disaster recovery and bulk backups, the missing warnings are more risky than in a non-destructive utility.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill exposes shell-based operational capability through documented script entrypoints but does not declare any tool scope, permissions, or allowed-tools boundary. That omission weakens least-privilege controls and makes it easier for an agent or user to invoke powerful filesystem and backup/restore operations without an explicit policy guardrail.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

## Prerequisites

- Archon identity configured (`~/.archon.env` with wallet path and passphrase)
- Run `archon-keymaster` first to create your DID if you don't have one

## Backup Operations

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Invoking npx @didcid/keymaster without an exact pinned version allows execution of whatever package version resolves at runtime. In a backup script handling encrypted vault operations and passphrase-protected wallet access, a compromised or malicious upstream package could exfiltrate sensitive backups, wallet material, or vault contents.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This unpinned npx invocation runs during archival of ~/.openclaw configuration, which may contain sensitive agent configuration and operational metadata. Because the script also exports ARCHON_PASSPHRASE, a malicious package version could access environment secrets and the files being uploaded to the vault.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The same supply-chain risk applies here for the optional hexmem database backup. Because this command processes a local database file that may contain memory/state data, compromise of the runtime-resolved package could disclose highly sensitive application data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Even though this invocation only lists vault items, it still executes unpinned code from the package registry and may run with access to the same environment and credentials. The impact is somewhat lower than the upload operations, but a malicious package could still harvest secrets or manipulate output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The script invokes npx @didcid/keymaster without pinning an exact package version, so npx may fetch and execute whatever version is currently published. In a disaster-recovery workflow handling a mnemonic and wallet restoration, a compromised or malicious upstream package could exfiltrate secrets or alter recovered data, making this substantially more dangerous than ordinary unpinned tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The recovery flow sends mnemonic-derived wallet recovery operations to a remote gatekeeper/seed-bank service but does not explicitly warn the operator that sensitive recovery metadata and wallet state will traverse the network. In a disaster-recovery context, users may reasonably expect a local-only process, so the missing disclosure increases the chance of unsafe use on untrusted networks or with untrusted endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This unpinned npx execution occurs during wallet DID recovery immediately after mnemonic import, when the environment contains highly sensitive recovery material. If the fetched package is substituted upstream, the attacker gains an ideal opportunity to steal wallet-derived secrets or manipulate identity recovery.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Listing recovered identities via an unpinned npx package still requires executing remote package code that may differ over time. Although this step is less sensitive than mnemonic import, it still runs in a wallet recovery context and could expose local wallet metadata or tamper with output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Checking for the backup alias executes an unpinned package in a sensitive recovery flow. A malicious or compromised package could falsify alias checks, misdirect restoration, or gather wallet metadata from the environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Listing vault items through unpinned npx introduces a supply-chain execution point before restore decisions are made. In this context, tampered package code could misreport available backup contents or trigger unauthorized network/data access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script again relies on an unpinned npx package to decide whether workspace.zip exists. Because restore logic is driven by this output, malicious package changes could influence control flow or hide/forge backup state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Downloading a vault item with an unpinned runtime-fetched package is especially risky because the package directly handles restored content and likely authenticated access to the vault. A compromised package could exfiltrate vault contents, credentials, or replace downloaded artifacts with attacker-controlled data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This unpinned package invocation determines whether config.zip exists in the backup vault. Even read-oriented operations are dangerous here because the code path runs with access to wallet state and network endpoints during recovery.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.