Security audit
Security checks across malware telemetry and agentic risk
GrayMatter is a disclosed business-memory integration, but it gives an agent broad authenticated access to live organizational data with automatic credential reuse and limited scoping controls.
Install only if you want this agent to use a ValkyrAI account as durable memory and to inspect or create RBAC-permitted business records. Use a dedicated least-privilege account or per-request token, avoid shared admin tokens, confirm which workspace/account Keychain credentials will be reused, and treat entity creation or generic API calls as actions requiring explicit user intent.
- `VALKYR_JWT_SESSION` as a compatible env fallback Preferred auth behavior is OpenClaw-first: - check Keychain for `VALKYR_AUTH` first - if present, reuse it automatically - otherwise prompt for username/password - exchange for a `VALKYR_AUTH` token
- if present, reuse it automatically - otherwise prompt for username/password - exchange for a `VALKYR_AUTH` token - store it in Keychain If activation can write/read by id and register the agent but semantic memory query is blocked by missing credits, treat that as a degraded startup state rather than total activation failure. Preserve auth, register the agent, sync the schema, and surface that query/list capability is limited until credits are available.
63/63 vendors flagged this skill as clean.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal
