registry / @agentvault/agentvault / 0.23.29
@agentvault/agentvault@0.23.29
The official **OpenClaw** plugin for AgentVault. Adds cryptographic identity, earned trust, and Signal-grade encrypted communications to OpenClaw agents. (Looking for a different framework? See **[Which Framework?](#which-framework)** below.)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThe source establishes a concrete, broad telemetry collection surface in an AI-agent extension, but no automatic lifecycle execution or covert install-time mutation. The explicit configuration command and lack of lifecycle hooks make a warning more appropriate than a block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
Enabling the OpenClaw plugin, or running agentvault setup.
Impact
Sensitive URL query data or event fields may be sent to AgentVault; setup changes the user's OpenClaw configuration.
Mechanism
Runtime telemetry interception and user-command OpenClaw configuration.
AI rationale
The source establishes a concrete, broad telemetry collection surface in an AI-agent extension, but no automatic lifecycle execution or covert install-time mutation. The explicit configuration command and lack of lifecycle hooks make a warning more appropriate than a block.
Evidence
dist/openclaw-entry.jsdist/cli.js~/.openclaw/openclaw.json~/.openclaw/agentvault
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The OpenClaw extension installs a fetch interceptor and records full request URLs.
- It converts arbitrary agent event fields into telemetry attributes.
- Telemetry spans are posted to the AgentVault backend with bearer authentication.
- The explicit setup command adds the plugin and AgentVault channel to OpenClaw configuration.
Evidence against
- package.json has no install lifecycle hook.
- The configuration mutation is behind the user-invoked setup command.
- The package is an OpenClaw peer extension rather than an automatically activated dependency.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
10 flaggeddist/cli.jsView file
78Source sends the broad process environment to a literal external destination.
L78: // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L79: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
L80: var init_libsodium_sumo = __esm({
...
L155: _Module = Module;
L156: Module.ready = new Promise(function(resolve4, reject) {
L157: var Module2 = _Module;
...
L226: quit_2 = (status, toThrow) => {
L227: process.exitCode = status;
L228: throw toThrow;
...
L240: xhr.responseType = "arraybuffer";
L241: xhr.send(null);
L242: return new Uint8Array(xhr.response);
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L7892393});
L92394: import { execSync } from "node:child_process";
L92395: import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync, chmodSync } from "node:fs";
High
92506try {
L92507: execSync("curl -sf --max-time 3 http://127.0.0.1:18789/", { stdio: "pipe" });
L92508: return { name: "Gateway port (18789)", status: "pass", message: "Responding" };
...
L92520: }
L92521: const home = process.env.HOME ?? "";
L92522: const warnings = [];
Findings
1 Critical7 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumDynamic Requiredist/openclaw-entry.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/cli.js
Affected versions and remediation
This report applies to @agentvault/agentvault@0.23.29.
See all versions of @agentvault/agentvault for other recorded verdicts.
- Review the evidence and your use of @agentvault/agentvault@0.23.29 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.