Agentvault

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:33 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a disclosed local credential-vault tool, but it combines secret handling with unpinned npm execution and autonomous persistent-memory reads, so users should review it carefully before installing.

Install only if you are comfortable auditing and pinning the npm package version first. Use a strong passphrase, avoid --skip-passphrase for real data, disable or require confirmation for autonomous memory queries, do not pass private keys directly on the command line, and treat .env imports plus vault, memory, and audit exports as sensitive operations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:96

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:96-108, SKILL.md:248-258, and references/commands.md:9-12
Vulnerability Type: Unpinned npm dependency and mutable supply-chain execution
Risk Level: High

Vulnerable Code

From SKILL.md:96-108:

bash

# Check if AgentVault is installed
agentvault --version

# Install globally
npm install -g @inflectiv-ai/agentvault

# Run directly without global install
npx @inflectiv-ai/agentvault init

From SKILL.md:248-258:

json

{
  "mcpServers": {
    "agentvault": {
      "command": "npx",
      "args": ["@inflectiv-ai/agentvault", "mcp", "start"],
      "env": {
        "AGENTVAULT_PASSPHRASE": "${AGENTVAULT_PASSPHRASE}"
      }
    }
  }
}

From references/commands.md:9-12:

text

Install: `npm install -g @inflectiv-ai/agentvault`
Version: 1.0.1

Technical Analysis

The installation and MCP examples identify the package only by name and do not pin an exact version or integrity digest. An unversioned npm install or npx invocation resolves a package release through the npm registry at execution time. Consequently, the code that executes can differ from the code reviewed when this Skill was published.

The MCP configuration makes this behavior persistent at the configuration level: each MCP launch can invoke npx against the unpinned package name. The Skill metadata identifies version 1.0.2, while the command reference states 1.0.1, further demonstrating that the documentation does not establish one immutable reviewed version.

Only documentation is included in the audited project. The implementation of @inflectiv-ai/agentvault is absent, so its claimed encryption, network isolation, telemetry behavior, secret handling, and sandbox enforcement cannot be verified from this artifact.

Attack Path

1. A user approves installation, initialization, or MCP configuration.
2. npm or npx r ...[truncated 1203 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin one reviewed package version everywhere, including installation commands and MCP configuration, for example:

   bash

   npm install -g @inflectiv-ai/agentvault@1.0.2
   npx --yes @inflectiv-ai/agentvault@1.0.2 init
   

2. Prefer a project-local dependency governed by a committed lockfile instead of global installation.
3. Verify the package tarball against a documented cryptographic digest before execution.
4. Include or link to an immutable source revision corresponding exactly to the pinned package release.
5. Configure MCP to invoke a locally installed, verified executable rather than allowing npx to resolve a mutable release at startup.
6. Reconcile the 1.0.1 and 1.0.2 version references and establish one audited version.
7. Perform dependency and provenance verification for the package and its transitive dependencies before recommending access to credentials.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:76

Finding

Autonomous Access to Decrypted Persistent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:76-79
Vulnerability Type: Access beyond explicit task-scoped authorization
Risk Level: Medium

Vulnerable Code

markdown

- **Starting a new task** → autonomously query memory to check for prior knowledge: `agentvault memory query "<topic>"`

Related autonomous-use authorization in SKILL.md:62-65:

markdown

**Safe for autonomous use (read-only, no side effects):**

- `agentvault memory query "<search>"` — search memory (read-only)
- `agentvault memory list` — list memory entries

Technical Analysis

The Skill treats persistent-memory searches as safe solely because they are read-only. Confidentiality and least privilege are nevertheless relevant to read operations. According to the Skill's own description, a memory query decrypts the encrypted memory file in process and returns matching content.

Automatically querying memory at the start of a task can retrieve information created during other projects or sessions without obtaining task-specific user authorization. A broad or adversarially influenced search term could expose unrelated preferences, project context, learned information, or other private text to the current Agent session.

The documentation does not specify project namespaces, tenant separation, entry-level access controls, metadata-only previews, or restrictions that bind autonomous queries to the current task.

Attack Path

1. The Skill is loaded for a new task.
2. Following its documented autonomous workflow, the Agent constructs a topic query without asking the user.
3. AgentVault decrypts and searches persistent memory.
4. Broadly matching entries from prior tasks or projects are returned.
5. Their content enters the active Agent context and may influence generated output, tool decisions, or subsequent requests.
6. If the current conversation or its downstream tools are not authorized for that hi ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit user confirmation before decrypting or returning persistent-memory content.
2. Partition memory by project, user, workspace, and sensitivity level.
3. Bind each query to an explicitly authorized namespace rather than searching the complete memory store.
4. Provide a metadata-only preview showing candidate entry names, types, and tags before returning content.
5. Apply entry-level access-control policies to both CLI and MCP memory operations.
6. Add audit records identifying the requesting task, query, matched entries, and authorization decision.
7. Remove memory query and memory list from the unconditional autonomous-use list, or limit autonomous access to entries explicitly marked safe for cross-task retrieval.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:150

Finding

Predictable Default Passphrase Permitted for Vault Initialization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:150-155 and references/commands.md:20-27
Vulnerability Type: Insecure default credential
Risk Level: High

Vulnerable Code

From SKILL.md:150-155:

bash

agentvault init
agentvault init --skip-passphrase  # Use default passphrase (dev only)

From references/commands.md:20-27:

text

agentvault init [options]

| Flag | Description |
|------|-------------|
| `--skip-passphrase` | Skip passphrase prompt and use default (development only) |

Technical Analysis

The documented option skips passphrase selection and uses a default passphrase. Encryption based on a shared or predictable default does not provide meaningful resistance once an attacker obtains the encrypted vault files. A random salt can protect against precomputed tables, but it does not compensate for a publicly known, low-entropy, or shared passphrase; an attacker can derive the key using the known default and the salt stored with the encrypted data.

Labeling the option as development-only is advisory and does not prevent a user from subsequently importing .env credentials or storing sensitive memory in a vault initialized this way. The documentation does not state that secret storage is blocked, that a warning is persisted, or that the vault must be re-keyed before sensitive operations.

Attack Path

1. A user follows the documented initialization example with --skip-passphrase.
2. The vault is initialized using the package's default passphrase.
3. The user later imports or stores credentials and persistent memory.
4. An attacker obtains a copy of .agentvault through source-control exposure, backup leakage, local file access, artifact collection, or another disclosure.
5. The attacker uses the known default passphrase and stored derivation parameters to derive the encryption key.
6. The attacker decrypts the affected vault and memory data, subject to th ...[truncated 591 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the shared default-passphrase option from user-facing guidance.
2. For noninteractive development initialization, generate a cryptographically random, unique passphrase for each vault.
3. Store generated credentials using operating-system credential storage or a file restricted to the owning user, rather than embedding a common default.
4. Mark development vaults explicitly and block secret add, secret import, memory store, and decrypted export until a strong passphrase is configured.
5. Enforce minimum passphrase strength and use a memory-hard key-derivation configuration with documented parameters.
6. Provide an authenticated re-key operation that replaces the development key before production use.
7. Display a prominent warning on every operation performed against a vault initialized with insecure development settings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

| `npm install -g @inflectiv-ai/agentvault` | Installs software on the user's machine |
| `agentvault init` | Creates directories and encrypted files |
| `agentvault secret add/remove` | Modifies encrypted credentials |
| `agentvault secret import .env` | Reads the user's .env file |
| `agentvault memory store` | Writes to encrypted memory |
| `agentvault memory remove` | Deletes memory entries |
| `agentvault mcp start` | Starts a local server process |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

| `npm install -g @inflectiv-ai/agentvault` | Installs software on the user's machine |
| `agentvault init` | Creates directories and encrypted files |
| `agentvault secret add/remove` | Modifies encrypted credentials |
| `agentvault secret import .env` | Reads the user's .env file |
| `agentvault memory store` | Writes to encrypted memory |
| `agentvault memory remove` | Deletes memory entries |
| `agentvault mcp start` | Starts a local server process |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The 'First-time setup' workflow includes agentvault secret import .env as a straight-line step, which normalizes reading a sensitive credential file as part of setup. Even though earlier sections mention approval, embedding .env import directly in a canned workflow makes accidental or over-eager credential ingestion by an agent more likely.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

bash

agentvault init
agentvault secret import .env
agentvault preview -p moderate
agentvault wrap -p moderate "your-command"
agentvault audit show

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

wallet import <key> handles raw private key material, one of the most sensitive credential types, yet the reference provides no warning about exposure risks from command-line arguments. Passing private keys directly on the CLI can leak them through shell history, process listings, logging, and terminal transcripts, making compromise of funds or signing authority possible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to launch the MCP server via npx @inflectiv-ai/agentvault without pinning an exact version. That allows execution of whatever package version npm resolves at runtime, increasing supply-chain risk if a malicious or compromised update is published or if resolution is manipulated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

bash

agentvault profile list
agentvault profile show moderate
agentvault profile create myprofile -d "Custom" -t 30 -r "AWS_*:deny" -r "NODE_ENV:allow"
agentvault profile clone moderate custom-moderate

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

secret import <file> ingests plaintext .env contents, but the reference provides no warning that users are handling unencrypted secret material before it enters the vault. In an agent-oriented secret-management tool, this omission increases the chance of users exposing secrets via unsafe files, shell history, shared workspaces, or accidental commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

memory export -o <file> writes persistent memory contents to disk, but the documentation does not warn that exported memory may contain sensitive agent context, user data, or internal knowledge. In a tool marketed for encrypted persistent memory, silent export to plaintext or unprotected files can undermine the security expectations users have about stored data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Audit logs can reveal sensitive operational metadata such as agent IDs, session activity, secret-access decisions, and timing information. Documenting audit export without warning users about the sensitivity of these artifacts increases the risk of inadvertent disclosure when logs are written to disk or shared externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest mentions running an MCP server for secret management, encrypted memory, and audit controls, but the documented MCP tool vault.sign_x402 suggests a specialized signing capability beyond vault, memory, and audit operations. That extra operation is not justified by the manifest's stated scope and changes the apparent purpose of the server.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes AgentVault as an encrypted credential vault, secret sandbox, persistent memory store, MCP server, and audit system for agent credential access. The documented wallet commands add generation, display, and import of blockchain private-key wallet material, which is a separate capability not implied by that purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The activation guidance is broad enough to trigger the skill for generic discussions about security, credentials, encrypted memory, or what an agent can see, even when the user did not ask to use this tool. In a credential-handling skill, over-activation increases the chance of unnecessary secret-management prompts, installs, or memory access suggestions in contexts where they are not needed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.