Storage Private — Encrypted Multi-Node Agent Storage

• Analyzed: May 14, 2026, 5:19 AM
• Findings: 1
• Version: 1.0.0
• Hash: ab4541b719442aa1d40af20d00b08c56d91e161e83a686babada46e40f3452ce
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides encrypted storage but requires access to a high-value ETH private key (read from `~/.openclaw/workspace/.secrets/eth-wallet.env`) to derive encryption keys. It communicates with a custom P2P network ('FilStream') via hardcoded IPv6 addresses (e.g., `2a05:a00:2::10:11` in `config.json` and `discover.mjs`). While it implements client-side ChaCha20-Poly1305 encryption before transmission, the handling of raw private keys and the use of non-standard remote storage nodes present a significant security risk. Additionally, `scripts/storage.mjs` contains a shell injection vulnerability in the `cmdDiscover` function where the `--max-nodes` argument is passed unsanitized to `execSync`.