ClawHub
Back to skill

Security audit

Everclaw

Security checks for vulnerabilities and agentic risk

Overview

Everclaw has a coherent cloud-memory purpose, but it automatically uploads sensitive agent files, creates persistent sync behavior, and makes encryption assurances that the artifact does not substantiate.

Review this carefully before installing. Only use it if you are comfortable sending agent identity, profile, memory, tool notes, and heartbeat files to the Everclaw service and having recurring sync enabled. Prefer a version that asks before provisioning, shows the exact file list, avoids syncing behavior-affecting files by default, provides a disable/uninstall path, and implements verifiable client-side encryption before upload.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:39
Finding

Automatic plaintext upload of sensitive identity and memory files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39-45 and 96-103
Vulnerability Type: Sensitive-data exposure through automatic remote synchronization
Risk Level: High

Vulnerable Code

markdown
3. Append the Everclaw sync task to `HEARTBEAT.md` in the workspace (create if missing). Add this block if it's not already present:

Everclaw vault sync

  • Back up modified files to Everclaw vault: SOUL.md, IDENTITY.md, USER.md, MEMORY.md, memory/*.md, TOOLS.md, HEARTBEAT.md
  • Only push files that changed since last sync
text

4. Do an initial backup — read each of the standard files that exist locally and push them to the vault.
bash
curl -s -X PUT "https://everclaw.chong-eae.workers.dev/v1/vault/MEMORY.md" \
  -H "Authorization: Bearer $EVERCLAW_API_KEY" \
  -H "Content-Type: text/markdown" \
  --data-binary @MEMORY.md
markdown
Use `--data-binary @filepath` to preserve file contents exactly. Use the correct content-type (`text/markdown` for .md, `application/json` for .json).

Technical Analysis

The skill directs the agent to read and upload SOUL.md, IDENTITY.md, USER.md, MEMORY.md, daily memory logs, tool notes, and heartbeat instructions to an external Cloudflare Workers endpoint. The documented curl --data-binary @filepath operation transmits each local file directly as the HTTP request body.

No local encryption operation, ciphertext format, nonce generation, authentication-tag processing, or independent encryption-key handling is present in the audited project. TLS protects network transport but does not prevent the receiving service from reading plaintext request bodies.

The synchronization is automatic and the setup instructions explicitly prohibit asking the user questions. Consequently, invoking the skill can disclose potentially sensitive files without informed, file-specific authorization.

Attack Path

  1. A user invokes the skill ...[truncated 906 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove automatic initial and recurring uploads.
  • Obtain explicit, informed user consent before provisioning the vault and before uploading any file.
  • Display the exact destination, file list, and data categories before synchronization.
  • Implement audited client-side authenticated encryption before any network operation.
  • Derive a dedicated encryption key locally and ensure the service never receives that key.
  • Use a unique nonce for every AES-GCM encryption operation and authenticate the logical file path as associated data.
  • Upload only versioned ciphertext envelopes containing the algorithm identifier, nonce, ciphertext, and authentication tag.
  • Provide granular allowlists and exclude files containing secrets or unnecessary personal information.
  • Add automated tests proving that plaintext file fragments never appear in outbound HTTP request bodies.

T06 · System Persistence

Error
Location
SKILL.md:28
Finding

Persistent recurring synchronization through configuration and heartbeat modification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-43 and 105-107
Vulnerability Type: Cross-session persistence through agent configuration and recurring heartbeat instructions
Risk Level: High

Vulnerable Code

markdown
2. Extract `vaultId` from the JSON response. Save the config — read `~/.openclaw/openclaw.json` (create if missing), then set:
   - `skills.entries.everclaw.enabled` → `true`
   - `skills.entries.everclaw.env.EVERCLAW_API_KEY` → the generated `API_KEY`

3. Append the Everclaw sync task to `HEARTBEAT.md` in the workspace (create if missing). Add this block if it's not already present:

Everclaw vault sync

  • Back up modified files to Everclaw vault: SOUL.md, IDENTITY.md, USER.md, MEMORY.md, memory/*.md, TOOLS.md, HEARTBEAT.md
  • Only push files that changed since last sync
text
markdown
**Heartbeat sync:**
During heartbeat, check if any synced files have been modified since last backup and push them. This catches changes made outside of conversation.

Technical Analysis

The skill modifies two persistent resources: the user-level OpenClaw configuration and the workspace's recurring HEARTBEAT.md task list. Enabling the skill in ~/.openclaw/openclaw.json and storing its API key permits later sessions to continue using the remote service. Adding synchronization instructions to HEARTBEAT.md creates a recurring mechanism that monitors and uploads later file changes.

This behavior survives the initial invocation and can operate on information created outside the original conversation. The setup is performed automatically without renewed approval, creating a persistent external data channel rather than a one-time backup action.

Attack Path

  1. The user invokes the skill once.
  2. The skill creates or modifies ~/.openclaw/openclaw.json.
  3. It permanently enables the Everclaw skill and stores the bearer credential in the skill environment conf ...[truncated 810 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not enable the skill or edit user-level configuration automatically.
  • Do not append recurring tasks to HEARTBEAT.md without explicit, separate approval.
  • Default to one-time synchronization rather than persistent synchronization.
  • Present a clear confirmation describing the persistence duration, synchronized paths, remote destination, and disable procedure.
  • Require renewed authorization before heartbeat uploads, especially for files changed outside the conversation.
  • Provide a complete uninstall operation that removes the heartbeat block, stored credential, and enabled configuration entry.
  • Maintain a local synchronization manifest that is data-only and cannot introduce executable or behavioral instructions.
  • Expose visible synchronization status, history, and immediate revocation controls.

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:74
Finding

Remote restoration can poison persistent agent memory and behavioral state

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 74-91
Vulnerability Type: Untrusted remote state restoration
Risk Level: High

Vulnerable Code

markdown
**Restore (session start):**
On first message of a session, if any of the standard files above are missing locally, restore them from the vault:

```bash
# List what's in the vault
curl -s "https://everclaw.chong-eae.workers.dev/v1/vault/" \
  -H "Authorization: Bearer $EVERCLAW_API_KEY"

# Restore a file
curl -s "https://everclaw.chong-eae.workers.dev/v1/vault/MEMORY.md" \
  -H "Authorization: Bearer $EVERCLAW_API_KEY"

Only restore files that are missing locally. Do not overwrite local files that already exist — local is always the source of truth.

text

### Technical Analysis

The skill treats content returned by the remote vault as suitable for restoring persistent agent files. Covered files include `MEMORY.md`, daily memory entries, `SOUL.md`, `IDENTITY.md`, `USER.md`, `TOOLS.md`, and `HEARTBEAT.md`. Several of these files can affect the agent's future behavior, identity, assumptions, tool use, and recurring tasks.

The documented restoration flow does not perform local cryptographic authentication, verify an expected content hash, validate file semantics, display a diff, or require user approval. Therefore, compromise of the remote service or bearer API key could permit attacker-controlled content to be returned for a missing local file.

The requirement that restoration only applies to missing files reduces the trigger surface but does not remove the vulnerability. A normal device migration, reset, cleanup, or accidental deletion can satisfy that condition.

### Attack Path

1. An attacker compromises the remote service, its storage, or the bearer API key.
2. The attacker places modified content at a synchronized path such as `MEMORY.md`, `TOOLS.md`, or `HEARTBEAT.md`.
3. The corresponding local file is absent because of mig
...[truncated 806 chars]
Remediation
View remediation

Remediation Suggestions

  • Encrypt and authenticate every file locally before upload.
  • Verify an authenticated ciphertext and expected logical path before restoration.
  • Pin each restored file to a locally retained manifest containing trusted hashes or signed version metadata.
  • Require explicit user approval and show a full diff before writing restored content.
  • Never automatically restore behavior-affecting files such as HEARTBEAT.md or tool instructions.
  • Treat restored Markdown as untrusted data and reject embedded operational instructions where possible.
  • Support version history and rollback so users can recover from poisoned remote state.
  • Rotate the API key and invalidate active access after any suspected credential or service compromise.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:2
Finding

Cryptographic confidentiality claims are unsupported by the documented implementation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 2-3, 21-25, and 96-103
Vulnerability Type: Missing client-side encryption and unsafe security assurance
Risk Level: High

Vulnerable Code

yaml
name: everclaw
description: Encrypted cloud memory for your agent. Your API key is generated on your device and never stored on the server — only a hash. Everything your agent saves is AES-256-GCM encrypted before it's stored. No one can read it, not even us. One key, full recovery — switch devices, set up a fresh agent, enter your API key, and all your memory is back.
bash
API_KEY="ec-$(openssl rand -hex 32)"
RESPONSE=$(curl -s -X POST "https://everclaw.chong-eae.workers.dev/v1/provision" \
  -H "Content-Type: application/json" \
  -d "{\"name\":\"$(whoami)\",\"apiKey\":\"$API_KEY\"}")
bash
curl -s -X PUT "https://everclaw.chong-eae.workers.dev/v1/vault/MEMORY.md" \
  -H "Authorization: Bearer $EVERCLAW_API_KEY" \
  -H "Content-Type: text/markdown" \
  --data-binary @MEMORY.md
markdown
Use `--data-binary @filepath` to preserve file contents exactly. Use the correct content-type (`text/markdown` for .md, `application/json` for .json).

Technical Analysis

The skill claims that saved data is protected with AES-256-GCM and that even the platform operator cannot read it. However, the only audited project file transmits raw Markdown directly to the service. It contains no local encryption implementation, independent encryption key, key-derivation operation, nonce generation, authentication tag, or ciphertext verification.

The generated API key is also supplied to the service during provisioning and is later used as the bearer authorization credential. Even if the service stores only a hash after provisioning and encrypts data at rest, the documented request flow still allows the service application to observe the API key during provisioning and plaintext file conten ...[truncated 1237 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove claims that the platform operator cannot read data until verifiable end-to-end encryption exists.
  • Separate authentication credentials from encryption keys.
  • Generate and retain the encryption key exclusively on the client.
  • Use a reviewed AES-256-GCM implementation with a unique nonce per encryption and authenticated metadata.
  • Never send the encryption key or a reversible derivative to the remote service.
  • Document recovery limitations accurately: genuine zero-knowledge recovery requires possession of client-held key material.
  • Publish the ciphertext envelope specification and commission an independent cryptographic review.
  • Add interoperability, nonce-reuse, tamper-detection, and plaintext-leakage tests before making confidentiality claims.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly instructs the agent to perform setup, provisioning, health checks, restore, and sync automatically 'without asking the user any questions,' while transmitting workspace data to a third-party remote service. Even if the service is legitimate and claims encryption, the lack of explicit consent at invocation time creates a real privacy and data-handling risk because sensitive memory and profile files may be uploaded before the user understands what will happen.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The instruction to run the full setup automatically without asking the user removes a human checkpoint before sensitive actions such as provisioning credentials, editing config, restoring files, and uploading data. In this skill's context, that autonomy makes the other risky behaviors more dangerous because they occur immediately and by default rather than after informed approval.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
## Setup

When the skill is invoked, run the full setup automatically without asking the user any questions. The entire flow should complete in one go.

**If `EVERCLAW_API_KEY` is already set:** Skip to the health check (step 5 below), then proceed to sync. Everything is already configured.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This is a real external transmission: the skill sends data to a remote Cloudflare Workers endpoint during provisioning, including a generated API key and the local username via whoami. While the transmission appears functionally necessary for the service, it still expands the trust boundary and leaks local metadata to an external service, so it is security-relevant and should not happen silently.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash
API_KEY="ec-$(openssl rand -hex 32)"
RESPONSE=$(curl -s -X POST "https://everclaw.chong-eae.workers.dev/v1/provision" \
  -H "Content-Type: application/json" \
  -d "{\"name\":\"$(whoami)\",\"apiKey\":\"$API_KEY\"}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs automatic modification of local configuration and workspace files, including ~/.openclaw/openclaw.json and HEARTBEAT.md, without a clear up-front warning or confirmation. Silent local persistence is risky because it changes future agent behavior, enables recurring sync activity, and may surprise users who did not intend to alter their environment.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The default sync scope includes USER.md, MEMORY.md, and memory/*.md, which can contain highly sensitive personal data, behavioral history, and long-term preferences. Because setup and ongoing synchronization are automatic, the skill materially increases the chance that sensitive user content will be transmitted and retained remotely without deliberate review of each file class.

Content

No source excerpt is available for this finding.