@agentvault/agentvault@0.23.60
End-to-end encrypted messaging for AI agents: connects an agent to its owner, rooms and other agents on AgentVault.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package automatically sends runtime telemetry containing agent identity, model names, and token counts, with no disclosure or opt-out identified in the reviewed paths. This merits a warning; the source does not substantiate the scanner’s claim of credential redirection to an unofficial gateway.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A connected device has persisted credentials and a hub ID; telemetry then flushes periodically.
Impact
Agent and model usage metadata is transmitted automatically; the reviewed spans do not include prompt or completion text.
Mechanism
The runtime sends authenticated span data to /api/v1/telemetry/ingest, including agent identity, model names, and token counts.
AI rationale
The package automatically sends runtime telemetry containing agent identity, model names, and token counts, with no disclosure or opt-out identified in the reviewed paths. This merits a warning; the source does not substantiate the scanner’s claim of credential redirection to an unofficial gateway.
Evidence
dist/cli.jsdist/index.js
Network endpoints1
api.agentvault.chat/api/v1/telemetry/ingest
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- After a device connection, the runtime creates a telemetry reporter when persisted device credentials and a hub ID are present.
- The reporter automatically flushes telemetry every 30 seconds.
- It posts authenticated telemetry to the configured API’s /api/v1/telemetry/ingest endpoint, including agent identity and package version.
- Reported spans include model names and input/output token counts; no prompt or completion text was found in the reviewed span fields.
Evidence against
- The manifest has no install, preinstall, or postinstall hook; prepublishOnly runs the build.
- The default API host is api.agentvault.chat, the package’s service, and the API URL can be configured.
- The CLI’s OpenClaw restart subprocess is only reached after the user confirms the prompt.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Source & flagged code
10 flaggeddist/cli.jsView file
93531});
L93532: import { execSync } from "node:child_process";
L93533: import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync, chmodSync, readdirSync, statSync } from "node:fs";
High
93644try {
L93645: execSync("curl -sf --max-time 3 http://127.0.0.1:18789/", { stdio: "pipe" });
L93646: return { name: "Gateway port (18789)", status: "pass", message: "Responding" };
...
L93658: }
L93659: const home = process.env.HOME ?? "";
L93660: const warnings = [];
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L93644129// ../../node_modules/libsodium-sumo/dist/modules-sumo-esm/libsodium-sumo.mjs
L130: var __filename, __dirname, url, path, Module, Module, root, window_, crypto_, randomValuesStandard, crypto2, randomValueNodeJS, _Module, libsodium_sumo_default;
L131: var init_libsodium_sumo = __esm({
...
L224: Module2.useBackupModule = function() {
L225: return new Promise(function(resolve6, reject2) {
L226: var Module3 = {};
...
L277: quit_2 = (status, toThrow) => {
L278: process.exitCode = status;
L279: throw toThrow;
...
L291: xhr.responseType = "arraybuffer";
L292: xhr.send(null);
L293: return new Uint8Array(xhr.response);
Findings
1 Critical7 High6 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/openclaw-entry.js
HighChild Processdist/cli.js
HighShell
HighSame File Env Network Executiondist/cli.js
HighCredential Redirect Persistencedist/index.js
HighCommand Output Exfiltrationdist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighSemantic Analysis Limiteddist/cli.js
MediumDynamic Requiredist/openclaw-entry.js
MediumNetwork
MediumEnvironment Vars
MediumOversized Source Filedist/index.js
MediumOversized Cli Entrypointdist/cli.js
Affected versions and remediation
This report applies to @agentvault/agentvault@0.23.60.
See all versions of @agentvault/agentvault for other recorded verdicts.
- Review the evidence and your use of @agentvault/agentvault@0.23.60 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.