@agentvault/agentvault@0.23.32
The official **OpenClaw** plugin for AgentVault. Adds cryptographic identity, earned trust, and Signal-grade encrypted communications to OpenClaw agents. (Looking for a different framework? See **[Which Framework?](#which-framework)** below.)
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis package is not an npm lifecycle attack, but its explicit setup path mutates an AI-agent control surface and enables remotely delivered instructions with backend-routed execution. That is a real, package-aligned capability requiring a warning rather than a malware block.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The user runs the agentvault setup or create CLI command, then OpenClaw loads the configured extension.
Impact
The AgentVault service can supply instructions to the enabled extension and receives authenticated skill invocation data; setup can persist the OpenClaw gateway through pm2.
Mechanism
Agent extension setup with remote skill delivery and backend-routed MCP execution.
AI rationale
This package is not an npm lifecycle attack, but its explicit setup path mutates an AI-agent control surface and enables remotely delivered instructions with backend-routed execution. That is a real, package-aligned capability requiring a warning rather than a malware block.
Evidence
dist/cli.jsdist/openclaw-entry.js~/.openclaw/openclaw.json~/.openclaw/openclaw.json.bak.pre-setup-${options.accountId}~/.openclaw/agentvault~/.openclaw/agents/${accountId}/agentvault
Network endpoints1
api.agentvault.chat
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- The user-invoked setup command installs the plugin and writes AgentVault settings plus an allow-list entry into the OpenClaw configuration.
- The extension downloads skill instructions from the AgentVault API using a stored device credential and exposes them as MCP prompts.
- Skill calls send their name, arguments, and instructions to the AgentVault backend for execution.
- The CLI can register the OpenClaw gateway with pm2 auto-start after setup.
Evidence against
- package.json has no preinstall, install, or postinstall lifecycle hook.
- The configuration and persistence operations are reached through explicit CLI setup or create commands requiring an invite token.
- The observed network host is the package's configured AgentVault API endpoint; no unrelated exfiltration receiver was found.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggeddist/cli.jsView file
78Source sends the broad process environment to a literal external destination.
L78: // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L79: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default;
L80: var init_libsodium_sumo = __esm({
...
L155: _Module = Module;
L156: Module.ready = new Promise(function(resolve4, reject) {
L157: var Module2 = _Module;
...
L226: quit_2 = (status, toThrow) => {
L227: process.exitCode = status;
L228: throw toThrow;
...
L240: xhr.responseType = "arraybuffer";
L241: xhr.send(null);
L242: return new Uint8Array(xhr.response);
Critical
Hardcoded Runtime Data Exfiltration
Source sends credentials or rich application records to a package-controlled external receiver enabled by default.
dist/cli.jsView on unpkg · L7892638});
L92639: import { execSync } from "node:child_process";
L92640: import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync, chmodSync, readdirSync, statSync } from "node:fs";
High
92751try {
L92752: execSync("curl -sf --max-time 3 http://127.0.0.1:18789/", { stdio: "pipe" });
L92753: return { name: "Gateway port (18789)", status: "pass", message: "Responding" };
...
L92765: }
L92766: const home = process.env.HOME ?? "";
L92767: const warnings = [];
Findings
1 Critical7 High6 Medium4 Low
CriticalHardcoded Runtime Data Exfiltrationdist/cli.js
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumDynamic Requiredist/openclaw-entry.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/cli.js
Affected versions and remediation
This report applies to @agentvault/agentvault@0.23.32.
See all versions of @agentvault/agentvault for other recorded verdicts.
- Review the evidence and your use of @agentvault/agentvault@0.23.32 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.