Claw Store 1.3.3

• Outcome: Review
• Latest audit: May 28, 2026 · 11:31 AM UTC
• Version: 1.3.7

Overview

Claw Store appears to be a real encrypted memory tool, but it needs Review because it persists sensitive agent memory and performs risky first-run setup and secret display flows.

Install only if you intentionally want durable agent memory. Use a dedicated wallet, avoid storing secrets or regulated data, run dependency installation yourself in a controlled environment, and require the agent to ask before saving new memories. Treat any displayed encryption key or mnemonic as a high-value secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not _NODE_MODULES.exists():
        print("[jackal-memory] Installing Jackal dependencies (first run — takes ~30s)...",
              file=sys.stderr)
        r = subprocess.run(
            ["npm", "install", "--prefix", str(_SKILL_DIR)],
            capture_output=True, text=True,
        )

• Confidence: 88% confidence
• Finding: Automatically running 'npm install' at first use executes arbitrary lifecycle scripts from dependencies and fetches code from the package registry at runtime. In an agent-skill context, this materially enlarges the supply-chain attack surface and can lead to arbitrary code execution on the host if a dependency or registry path is compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill requires sensitive capabilities including environment access, local file read/write, network access, and shell execution, but these permissions are not explicitly declared in the manifest. This creates a transparency and governance gap: users and platforms cannot accurately evaluate the trust boundary before invocation, increasing the chance of unintended secret access or external data exfiltration through the helper scripts.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Printing the wallet mnemonic in cleartext to stdout exposes the secret to terminal logs, shell history capture, orchestration logs, notebooks, or any supervising agent framework that records command output. Because the mnemonic controls the user's on-chain storage identity, disclosure can lead to full account compromise and loss of confidentiality or control.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Rerunning walletgen reveals an already-stored mnemonic in cleartext without confirmation, turning a harmless status check into a credential disclosure event. In agent environments where outputs are often logged or forwarded, this greatly increases the chance of accidental secret exfiltration.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Behaviour guidelines

- Load your identity/memory blob on startup before doing any work
- Write locally during the session as normal
- Call save at session end or on significant state changes
- Use descriptive keys: `identity`, `session-2026-02-26`, `project-jackal`
- Never log or expose `JACKAL_MEMORY_API_KEY` in output

• Confidence: 90% confidence
• Finding: The skill instructs the agent to persist session and identity memory across runs and to proactively suggest backing up important information. Even with client-side encryption, this increases the risk of retaining sensitive personal, operational, or proprietary data longer than necessary, and the guidance allows storing secrets if a user explicitly requests it, which can create durable high-value targets on disk and in decentralized storage.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: jackal-memory/jackal-client.js:55