
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
Structured memory system for AI agents — typed storage, knowledge graph, context profiles, canvas dashboards, neural graph themes, and Obsidian-native task views. An elephant never forgets. 🐘
Structured memory system for AI agents and operators: typed markdown memory, graph-aware context, task/project primitives, Obsidian views, and OpenClaw hook integration.
Local-first. Markdown-first. Built to survive long-running autonomous work.
$CLAW: 5Fjr82MTB8mvxkzi9FYtvrUsPiDGE2M29w3dYcZpump
qmd installed and available on PATHClawVault currently relies on qmd for core vault/query flows. Install it before first use.
npm install -g clawvault
# 1) Create or initialize a vault
clawvault init ~/memory --name my-brain
# 2) Optional vault bootstrap for Obsidian
clawvault setup --theme neural --canvas
# 3) Verify OpenClaw compatibility in this environment
clawvault compat
If you want hook-based lifecycle integration, use this sequence:
# Install CLI
npm install -g clawvault
# Install and enable hook pack
openclaw hooks install clawvault
openclaw hooks enable clawvault
# Verify
openclaw hooks list --verbose
openclaw hooks info clawvault
openclaw hooks check
clawvault compat
Important:
clawhub install clawvault installs skill guidance, but does not replace hook-pack installation.Append these to your existing memory workflow. Do not replace your full prompt setup:
## ClawVault
- Run `clawvault wake` at session start.
- Run `clawvault checkpoint` during heavy work.
- Run `clawvault sleep "summary" --next "next steps"` before ending.
- Use `clawvault context "<task>"` or `clawvault inject "<message>"` before complex decisions.
Core:
init, setup, store, captureremember, list, get, stats, reindex, syncContext + memory:
search, vsearch, context, injectobserve, reflect, session-recapgraph, entities, link, embedResilience:
wake, sleep, handoff, recapcheckpoint, recover, status, clean-exit, repair-sessioncompat, doctorExecution primitives:
task ..., backlog ..., blocked, project ..., kanban ...canvas (generates default dashboard.canvas)Networking:
tailscale-status, tailscale-sync, tailscale-serve, tailscale-discover# Store and retrieve memory
clawvault remember decision "Use PostgreSQL" --content "Chosen for JSONB and reliability"
clawvault search "postgresql"
clawvault vsearch "what did we decide about storage"
# Session lifecycle
clawvault wake
clawvault checkpoint --working-on "auth rollout" --focus "token refresh edge cases"
clawvault sleep "finished auth rollout plan" --next "implement migration"
# Work management
clawvault task add "Ship v2 onboarding" --owner agent --project core --priority high
clawvault blocked
clawvault project list --status active
clawvault kanban sync
# Obsidian projection
clawvault canvas
--theme neural|minimal|none)all-tasks.base, blocked.base, by-project.base, by-owner.base, backlog.base)dashboard.canvas) via --canvas or clawvault canvasclawvault kanban syncclawvault kanban importClawVault can serve vault content for sync over Tailscale and exposes WebDAV under /webdav for mobile-oriented workflows.
clawvault tailscale-status
clawvault tailscale-serve --vault ~/memory
clawvault tailscale-discover
openclaw hooks install clawvault firstopenclaw hooks enable clawvaultopenclaw hooks list --verboseqmd errors:
qmd --version works from same shellclawvault setup after qmd installclawvault compatclawvault repair-session --dry-run then clawvault repair-sessionMIT
FAQs
Structured memory system for AI agents — typed storage, knowledge graph, context profiles, canvas dashboards, neural graph themes, and Obsidian-native task views. An elephant never forgets. 🐘
The npm package clawvault receives a total of 779 weekly downloads. As such, clawvault popularity was classified as not popular.
We found that clawvault demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.