Security audit

ClawSeal

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real persistent memory tool, but it automatically installs an always-on local service with weak access controls and unreliable integrity verification.

Review carefully before installing. This skill will run a persistent local memory service and store long-lived user or project information. Install only if you accept that background service, and prefer waiting for authentication, opt-in service registration, deletion controls, dependency pinning, and corrected verification behavior.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

Location: install.sh:32
Finding: Installer Automatically Registers a Cross-Session Background Service
Content: View full analysis
"$PLIST_PATH" <RunAtLoad KeepAlive ... EOF launchctl unload "$PLIST_PATH" 2>/dev/null || true launchctl load "$PLIST_PATH" elif [ "$OS" = "Linux" ]; then echo "🐧 Detected Linux — Registering systemd service..." UNIT_FILE="$HOME/.config/systemd/user/clawseal-server.service" PLUGIN_DIR="$(pwd)" mkdir -p "$HOME/.config/systemd/user" cat > "$UNIT_FILE" <
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: backend/clawseal_server.py:21
Finding: Unauthenticated Memory API Permits Persistent Memory Poisoning and Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: backend/clawseal_server.py:84
Finding: Verification Endpoint Hard-Codes Successful Integrity Results
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:11
Finding: Mutable Dependencies and Broken Shell Version Constraint Create Supply-Chain Risk
Content: View full analysis
=1.1.3 # Install Flask dependencies echo "📦 Installing Flask server dependencies..." pip install -r backend/requirements.txt ``` ```text clawseal>=1.1.3 flask>=2.3.0 flask-cors>=4.0.0 ``` The Skill metadata also requests installation by package name without a reviewed immutable artifact: ```yaml install: - id: pip kind: python package: clawseal ``` ### Technical Analysis All runtime dependencies use lower-bound constraints and therefore permit arbitrary future versions. A later compromised, malicious, or incompatible release can be selected during installation even though that release was never part of this audit. The direct shell command contains an additional defect: ```bash pip install clawseal>=1.1.3 ``` In a shell, the unquoted `>` character is parsed as output redirection. The effective command installs `clawseal` without the intended version constraint and redirects output into a file named `=1.1.3`. The installer therefore does not enforce the version requirement it appears to specify. Python package installation can execute build backends or other package-controlled installation behavior. The resulting packages are then imported by the server and continuously executed by the registered background service. ### Attack Path 1. The user runs `install.sh` or invokes the Skill’s package installation flow. 2. The shell parses `>` as redirection, so the direct ClawSeal installation is unconstrained. 3. Pip resolves current package releases from PyPI using mutable lower-bound requirements. 4. A future compromised or malicious package release is downloaded and installed. 5. Packa ...[truncated 847 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a memory utility, but the content also describes installing and running a persistent local server on port 5002, with daemon-like behavior not clearly declared in the metadata. This mismatch is dangerous because users and orchestration systems may approve a seemingly simple memory skill without realizing it introduces a continuously running service and local HTTP interface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide explicitly promotes storing user preferences, facts, insights, and decisions 'forever' across sessions, but it does not warn about consent, retention, minimization, deletion, or sensitive-data handling. For a memory product aimed at persistent user profiling, omission of privacy guidance can lead operators to retain personal data indefinitely and inappropriately, creating real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 42)May include surrounding context.
md
## How It Works with OpenClaw's Existing Memory **OpenClaw's memory** (if it has any): Ephemeral, session-scoped, no verification. **ClawSeal's memory**: Persistent, cryptographically signed, tamper-evident.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installation section states that running install.sh will register an auto-start daemon and start a local server, but it frames this as routine setup without a clear warning about persistence and background execution. Users may unintentionally install a continuously running service, increasing attack surface and causing unexpected system changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 78)May include surrounding context.
Step 2: Verify Server is Running

bash
curl http://localhost:5002/health # {"status": "ok", "service": "clawseal-openclaw-server"}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README tells users to run an installation script that both installs the package and registers an auto-start daemon, but the persistence side effect is not presented as a prominent consent step before execution. This is dangerous because users may execute the script expecting a simple local install while unknowingly granting long-lived background execution and boot persistence.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 195)May include surrounding context.
md
### Demo Mode (Default) - **Secret**: Auto-generated persistent secret at `~/.clawseal/demo_secret` (chmod 600) - **Artifacts**: Marked with `"qseal_mode": "demo_ephemeral"`, `"qseal_production": false` - **Use case**: Testing, development, demos - **Security**: NOT production-ready (ephemeral secret)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 80)May include surrounding context.
md
### Demo Mode (Default) - **Secret**: Auto-generated persistent secret at `~/.clawseal/demo_secret` (chmod 600) - **Artifacts**: Marked with `"qseal_mode": "demo_ephemeral"`, `"qseal_production": false` - **Use case**: Testing, development, demos - **Security**: NOT production-ready (ephemeral secret)

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
### Demo Mode (Default) - **Secret**: Auto-generated persistent secret at `~/.clawseal/demo_secret` (chmod 600) - **Artifacts**: Marked with `"qseal_mode": "demo_ephemeral"`, `"qseal_production": false` - **Use case**: Testing, development, demos - **Security**: NOT production-ready (ephemeral secret)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 218)May include surrounding context.
md
# Restart server (will detect QSEAL_SECRET) # macOS: launchctl unload ~/Library/LaunchAgents/com.mvar.clawseal.plist launchctl load ~/Library/LaunchAgents/com.mvar.clawseal.plist # Linux: systemctl --user restart clawseal-server

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 100)May include surrounding context.
md
# Restart server (will detect QSEAL_SECRET) # macOS: launchctl unload ~/Library/LaunchAgents/com.mvar.clawseal.plist launchctl load ~/Library/LaunchAgents/com.mvar.clawseal.plist # Linux: systemctl --user restart clawseal-server

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 122)May include surrounding context.
md
# Restart server (will detect QSEAL_SECRET) # macOS: launchctl unload ~/Library/LaunchAgents/com.mvar.clawseal.plist launchctl load ~/Library/LaunchAgents/com.mvar.clawseal.plist # Linux: systemctl --user restart clawseal-server

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · install.sh (reported line 147)May include surrounding context.
sh
# Restart server (will detect QSEAL_SECRET) # macOS: launchctl unload ~/Library/LaunchAgents/com.mvar.clawseal.plist launchctl load ~/Library/LaunchAgents/com.mvar.clawseal.plist # Linux: systemctl --user restart clawseal-server

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises shell-based installation and verification behavior but does not declare any explicit tool scope or allowed-tools constraints. That creates an authorization gap where an agent may invoke shell/network-capable actions without clear least-privilege boundaries, increasing the chance of unintended command execution or broader host interaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill stores persistent user memories and preferences, but the point-of-use documentation does not clearly warn about retention, sensitivity, deletion, or consent. In context, this is more dangerous because the entire purpose of the skill is long-lived storage of potentially personal conversation data, so privacy expectations and handling rules need to be explicit.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
Usage:

bash
curl -X POST http://localhost:5002/remember \ -H "Content-Type: application/json" \ -d '{ "content": "User prefers concise technical explanations",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The /remember endpoint accepts arbitrary client input and persists it to local storage with no authentication, authorization, or user consent flow. In this skill’s context, the service is explicitly a memory backend for AI agents, so unauthenticated writes can let any local or network-accessible caller poison agent memory, store sensitive data unexpectedly, or fill disk with attacker-controlled content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The demo explicitly shows storing and later recalling user preferences and project details, but it provides no consent flow, privacy notice, retention guidance, or data minimization warning. Even though the endpoint is localhost in a demo, the skill normalizes persistence of user-specific data and could lead downstream agents or operators to collect sensitive personal/work information without adequate disclosure or controls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · demo_conversation.md (reported line 23)May include surrounding context.
Agent Action (via curl):

bash
curl -X POST http://localhost:5002/remember \ -H "Content-Type: application/json" \ -d '{ "content": "User prefers concise technical explanations without marketing jargon",

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The installer goes beyond package setup and silently provisions a persistent local daemon that starts automatically on login/boot. Even if the server is part of intended functionality, persistence materially expands attack surface and user impact, especially since the skill is described primarily as cryptographic memory storage rather than an always-on background service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installer creates and enables an auto-start service without prompting the user or clearly warning before making persistent system changes. Unannounced persistence is risky because users may not realize they now have a background server that restarts automatically and may expose additional interfaces or process untrusted data over time.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 217)May include surrounding context.
md
if [ "$OS" = "Darwin" ]; then echo "🍎 Detected macOS — Registering launchd service..." # Create launchd plist PLIST_PATH="$HOME/Library/LaunchAgents/com.mvar.clawseal.plist" PLUGIN_DIR="$(pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · OPENCLAW_INTEGRATION.md (reported line 218)May include surrounding context.
md
if [ "$OS" = "Darwin" ]; then echo "🍎 Detected macOS — Registering launchd service..." # Create launchd plist PLIST_PATH="$HOME/Library/LaunchAgents/com.mvar.clawseal.plist" PLUGIN_DIR="$(pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 99)May include surrounding context.
md
if [ "$OS" = "Darwin" ]; then echo "🍎 Detected macOS — Registering launchd service..." # Create launchd plist PLIST_PATH="$HOME/Library/LaunchAgents/com.mvar.clawseal.plist" PLUGIN_DIR="$(pwd)"

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 100)May include surrounding context.
md
if [ "$OS" = "Darwin" ]; then echo "🍎 Detected macOS — Registering launchd service..." # Create launchd plist PLIST_PATH="$HOME/Library/LaunchAgents/com.mvar.clawseal.plist" PLUGIN_DIR="$(pwd)"

Overview

A.I.G

T06 · System Persistence

T02 · Agent Memory Poisoning

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

External Transmission

Step 2: Verify Server is Running

Missing User Warnings

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Undeclared Tool Scope

Missing User Warnings

External Transmission

Missing User Warnings

Missing User Warnings

External Transmission

Description-Behavior Mismatch

Missing User Warnings

Session Persistence

Session Persistence

Session Persistence

Session Persistence