← Back to Scanner

clawvault Security Audit Report

🔭 Continuously monitored by ClawSecure Watchtower
Source:
SHA-256:

clawvault is an AI agent skill, created by g9pedro and published at openclaw/skills. ClawSecure audited clawvault across 76 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 11 findings concentrate in Code Injection, Supply Chain and Permissions Manifest, including Vulnerability in vitest@1.2.0: Vitest allows Remote Code Execution when... and Attempts to access sensitive file: MEMORY.md. 9 were rated high or critical severity.

Is clawvault safe?

ClawSecure audited clawvault and assigned a security score of 0/100 (High Risk), identifying 11 findings across Code Injection and Supply Chain. Review the findings below before installing.

What did ClawSecure find in clawvault?

ClawSecure identified 11 findings in clawvault, concentrated in Code Injection, Supply Chain and Permissions Manifest. 9 were rated high or critical severity. The most severe include Vulnerability in vitest@1.2.0: Vitest allows Remote Code Execution when... and Attempts to access sensitive file: MEMORY.md.

How was clawvault audited?

ClawSecure ran clawvault through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 76 files from openclaw/skills.

What does a score of 0 mean?

ClawSecure assigned clawvault a security score of 0/100, placing it in the High Risk range. This is driven by 11 findings led by Code Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).

Audit Findings for clawvault

ClawSecure detected 11 security findings in clawvault, spanning Code Injection, Supply Chain, Permissions Manifest and Malicious Code.

Each finding is expandable in the interactive list below.

3-Layer Audit Protocol

Security Recommendations for clawvault

Eliminate dynamic code execution
clawvault evaluates code at runtime (for example eval or dynamic exec). Remove dynamic evaluation of untrusted input, and where code generation is unavoidable, sandbox it and validate every input.
Update and pin dependencies
clawvault depends on packages with supply-chain risk. Pin every dependency to an exact version, update packages with known CVEs to patched releases, and re-audit after each change. ClawSecure checks every dependency against known CVE databases.
Add a config.json permissions manifest
A config.json file declares what an agent component can access: file system, network, shell execution and more. Without it, users have no visibility into what the component can do before installing. This is the single most impactful security improvement for any AI agent skill.

Related Security Research

Why Generic Scanners Fail at AI Agent SecurityBeyond Static Scans: Why ClawSecure Verifies Agentic Intent

Related AI Agent Security Audits

anysearchScore 0/100ai-ppt-generatorScore 0/100capability-evolverScore 0/100capability-evolverScore 0/100youtube-summarizeScore 0/100

Scanned on February 12, 2026. clawvault is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.

Start Your Free Scan