registry / @agentvault/agentvault / 0.23.19
@agentvault/agentvault@0.23.19
The official **OpenClaw** plugin for AgentVault. Adds cryptographic identity, earned trust, and Signal-grade encrypted communications to OpenClaw agents. (Looking for a different framework? See **[Which Framework?](#which-framework)** below.)
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is a user-invoked first-party agent extension setup flow, not concrete malicious install-time behavior. Warn because it can alter an AI-agent control surface and establish persistence when requested.
Static reason
High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source
Trigger
User runs agentvault setup, create, pm2-setup, or doctor --fix.
Impact
Can modify the user's OpenClaw configuration and start a persistent gateway process.
Mechanism
explicit OpenClaw configuration and gateway persistence setup
AI rationale
This is a user-invoked first-party agent extension setup flow, not concrete malicious install-time behavior. Warn because it can alter an AI-agent control surface and establish persistence when requested.
Evidence
package.jsonopenclaw.plugin.jsondist/cli.jsdist/openclaw-entry.jsdist/index.js~/.openclaw/openclaw.json~/.openclaw/agentvault~/Library/LaunchAgents/ai.openclaw.gateway.plist~/.openclaw/openclaw-gateway-wrapper.sh
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- dist/cli.js: setup explicitly installs/enables an OpenClaw plugin and patches its config.
- dist/cli.js: pm2 setup creates a persistent openclaw-gateway process after user-invoked setup.
- dist/cli.js: doctor --fix can rewrite a macOS LaunchAgent plist and wrapper.
- dist/openclaw-entry.js: runtime sends authenticated AgentVault API requests.
Evidence against
- package.json has no preinstall, install, postinstall, or prepare lifecycle hook.
- CLI mutations are reached only through explicit setup/create/pm2-setup or doctor --fix commands.
- Command output is used for local diagnostics; no source path sends it to AgentVault.
- Observed API host is package-aligned: api.agentvault.chat.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
12 flaggeddist/cli.jsView file
35Source sends the broad process environment to a literal external destination.
L35: // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L36: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
L37: var init_libsodium_sumo = __esm({
...
L112: _Module = Module;
L113: Module.ready = new Promise(function(resolve4, reject) {
L114: var Module2 = _Module;
...
L183: quit_2 = (status, toThrow) => {
L184: process.exitCode = status;
L185: throw toThrow;
...
L197: xhr.responseType = "arraybuffer";
L198: xhr.send(null);
L199: return new Uint8Array(xhr.response);
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L3535// ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L36: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
L37: var init_libsodium_sumo = __esm({
...
L112: _Module = Module;
L113: Module.ready = new Promise(function(resolve4, reject) {
L114: var Module2 = _Module;
...
L183: quit_2 = (status, toThrow) => {
L184: process.exitCode = status;
L185: throw toThrow;
...
L197: xhr.responseType = "arraybuffer";
L198: xhr.send(null);
L199: return new Uint8Array(xhr.response);
Critical
Command Output Exfiltration
Source executes local commands and sends command output to an external endpoint.
Findings
4 Critical5 High7 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
CriticalCommand Output Exfiltrationdist/cli.js
CriticalTrigger Reachable Dangerous Capabilitydist/cli.js
CriticalPrevious Version Dangerous Deltadist/openclaw-entry.js
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Persistencedist/cli.js
MediumDynamic Requiredist/openclaw-entry.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/cli.js
Affected versions and remediation
This report applies to @agentvault/agentvault@0.23.19.
See all versions of @agentvault/agentvault for other recorded verdicts.
- Review the evidence and your use of @agentvault/agentvault@0.23.19 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.