registry / AI-agent capability abuse / @agentvault/agentvault / 0.23.44

@agentvault/agentvault@0.23.44

The official **OpenClaw** plugin for AgentVault. Adds cryptographic identity, earned trust, and Signal-grade encrypted communications to OpenClaw agents. (Looking for a different framework? See **[Which Framework?](#which-framework)** below.)

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The source establishes an explicit-user-command agent configuration capability and networked backup behavior, warranting a warning. It does not establish malicious install-time behavior or a complete malicious lifecycle chain.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the setup or create CLI command with an invite token.

Impact

The command can alter the local AI-agent control configuration and send encrypted session backup data to the selected service.

Mechanism

Explicit OpenClaw configuration mutation and credentialed service communication.

AI rationale

Evidence

dist/cli.js~/.openclaw/openclaw.json~/.openclaw/workspace-${name}~/.openclaw/agents/${name}/agentvault-data

Network endpoints1

api.agentvault.chat

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit setup/create CLI modifies OpenClaw channel settings and adds the package to the plugin allowlist.
Its backup routine encrypts session material and uploads it to the configured service using a device token.
The default service endpoint is api.agentvault.chat.

Evidence against

package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
The configuration-changing behavior is reached through explicit CLI setup/create commands, not package installation.
No source evidence showed self-dependency, hidden payload execution, or unconsented install-time mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

dist/cli.jsView file

111Source sends the broad process environment to a literal external destination. L111: // ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs L112: var __filename, __dirname, url2, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto4, randomValueNodeJS, _Module, libsodium_sumo_default; L113: var init_libsodium_sumo = __esm({ ... L188: _Module = Module; L189: Module.ready = new Promise(function(resolve4, reject) { L190: var Module2 = _Module; ... L259: quit_2 = (status, toThrow) => { L260: process.exitCode = status; L261: throw toThrow; ... L273: xhr.responseType = "arraybuffer"; L274: xhr.send(null); L275: return new Uint8Array(xhr.response);

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L111

•matchType = previous_version_dangerous_delta matchedPackage = @agentvault/agentvault@0.23.43 matchedIdentity = npm:QGFnZW50dmF1bHQvYWdlbnR2YXVsdA:0.23.43 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 Critical7 High6 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/cli.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighSemantic Analysis Limiteddist/cli.js

MediumDynamic Requiredist/openclaw-entry.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

Affected versions and remediation

This report applies to @agentvault/agentvault@0.23.44.

See all versions of @agentvault/agentvault for other recorded verdicts.

Review the evidence and your use of @agentvault/agentvault@0.23.44 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 13:08:59.061Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

registry / AI-agent capability abuse / @agentvault/agentvault / 0.23.44

@agentvault/agentvault@0.23.44

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

A user runs the setup or create CLI command with an invite token.

Impact

The command can alter the local AI-agent control configuration and send encrypted session backup data to the selected service.

Mechanism

Explicit OpenClaw configuration mutation and credentialed service communication.

AI rationale

Evidence

dist/cli.js~/.openclaw/openclaw.json~/.openclaw/workspace-${name}~/.openclaw/agents/${name}/agentvault-data

Network endpoints1

api.agentvault.chat

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The explicit setup/create CLI modifies OpenClaw channel settings and adds the package to the plugin allowlist.
Its backup routine encrypts session material and uploads it to the configured service using a device token.
The default service endpoint is api.agentvault.chat.

Evidence against

package.json has no preinstall, install, or postinstall hook; its only lifecycle hook is prepublishOnly.
The configuration-changing behavior is reached through explicit CLI setup/create commands, not package installation.
No source evidence showed self-dependency, hidden payload execution, or unconsented install-time mutation.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

11 flagged

dist/cli.jsView file

Critical

Hardcoded Runtime Data Exfiltration

Source sends credentials or rich application records to a package-controlled external receiver enabled by default.

dist/cli.jsView on unpkg · L111

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Findings

2 Critical7 High6 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationdist/cli.js

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/cli.js

HighShell

HighSame File Env Network Executiondist/cli.js

HighCredential Redirect Persistencedist/index.js

HighCommand Output Exfiltrationdist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighSemantic Analysis Limiteddist/cli.js

MediumDynamic Requiredist/openclaw-entry.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Source Filedist/index.js

Affected versions and remediation

This report applies to @agentvault/agentvault@0.23.44.

See all versions of @agentvault/agentvault for other recorded verdicts.

Review the evidence and your use of @agentvault/agentvault@0.23.44 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-13 13:08:59.061Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.