clawvault is an AI agent skill, created by g9pedro and published at openclaw/skills. ClawSecure audited clawvault across 76 files through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 11 findings concentrate in Code Injection, Supply Chain and Permissions Manifest, including Vulnerability in vitest@1.2.0: Vitest allows Remote Code Execution when... and Attempts to access sensitive file: MEMORY.md. 9 were rated high or critical severity.
Is clawvault safe?
ClawSecure audited clawvault and assigned a security score of 0/100 (High Risk), identifying 11 findings across Code Injection and Supply Chain. Review the findings below before installing.
What did ClawSecure find in clawvault?
ClawSecure identified 11 findings in clawvault, concentrated in Code Injection, Supply Chain and Permissions Manifest. 9 were rated high or critical severity. The most severe include Vulnerability in vitest@1.2.0: Vitest allows Remote Code Execution when... and Attempts to access sensitive file: MEMORY.md.
How was clawvault audited?
ClawSecure ran clawvault through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage, scanning 76 files from openclaw/skills.
What does a score of 0 mean?
ClawSecure assigned clawvault a security score of 0/100, placing it in the High Risk range. This is driven by 11 findings led by Code Injection that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for clawvault
ClawSecure detected 11 security findings in clawvault, spanning Code Injection, Supply Chain, Permissions Manifest and Malicious Code.
- critical · Vulnerability in vitest@1.2.0: Vitest allows Remote Code Execution when.... Supply Chain finding detected in
package.json. - high · Attempts to access sensitive file: MEMORY.md. Malicious Code finding detected in
README.md. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
vault-parser.js. - high · Potentially dangerous code pattern detected: eval\(. Code Injection finding detected in
graph.js. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
handler.js. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
session-recap.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
status.ts. - high · Potentially dangerous code pattern detected: exec\(. Code Injection finding detected in
auto-linker.ts. - high · Vulnerability in glob@10.3.10: glob CLI: Command injection via -c/--cmd.... Supply Chain finding detected in
package.json. - medium · Missing config.json - agent may not be properly configured. Permissions Manifest finding.
- low · Vulnerability in tsup@8.0.1: tsup DOM Clobbering vulnerability. Supply Chain finding detected in
package.json.
Each finding is expandable in the interactive list below.
3-Layer Audit Protocol
Security Recommendations for clawvault
Eliminate dynamic code execution
Update and pin dependencies
Add a config.json permissions manifest
Related Security Research
Why Generic Scanners Fail at AI Agent Security→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on February 12, 2026. clawvault is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.