ClawHub
Back to skill

Security audit

Gasless Agent Wallet(SOL/EVM)

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill is purpose-aligned but should be reviewed carefully because it uses unpinned wallet CLI execution for private-key and financial operations and documents weak Solana limit accounting.

Install only after reviewing the actual `@agntos/agentwallet` package source and pinning a specific trusted version. Avoid generating or displaying private keys in logged agent sessions or CI, prefer managed wallets, verify wallet addresses and setup URLs before funding, and treat Solana spending limits as uncertain unless the deployed program proves that valuations cannot be supplied or understated by the agent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:25
Finding

Unpinned Third-Party Wallet CLI Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-86 and 186-235
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash
npx @agntos/agentwallet keygen
npx @agntos/agentwallet keygen --chain base
npx @agntos/agentwallet keygen --chain solana
npx @agntos/agentwallet keygen --json

npx @agntos/agentwallet create --agent 0xYOUR_BASE_ADDRESS --agent-sol YOUR_SOLANA_PUBKEY
npx @agntos/agentwallet create --agent 0xYOUR_BASE_ADDRESS --agent-sol YOUR_SOLANA_PUBKEY --unmanaged

npx @agntos/agentwallet status 0xWALLET
npx @agntos/agentwallet limits 0xWALLET --daily N --pertx N --reason "..."
npx @agntos/agentwallet token-limit 0xWALLET --token 0x... --token-daily N --token-pertx N
npx @agntos/agentwallet pause 0xWALLET --reason "..."

Technical Analysis

The skill repeatedly directs the agent to execute @agntos/agentwallet through npx without pinning an exact package version or verifying package integrity. Depending on the local npm configuration and cache state, npx may retrieve and execute the version currently resolved from the package registry.

This creates a supply-chain trust boundary that is not represented by auditable code in the project. The repository contains only SKILL.md; therefore, the implementation that generates private keys, creates wallets, and initiates financial operations cannot be reviewed from the supplied artifact.

This is especially sensitive because the package is expected to handle private keys and wallet transactions. A compromised publisher account, malicious future release, registry compromise, or dependency compromise could change the executable payload after this skill has been reviewed.

Attack Path

  1. An attacker compromises the npm publisher, package, registry resolution path, or one of the package's transitive dependencies.
  2. The attacker publishes a malicious version under the same package ...[truncated 1085 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to a reviewed exact version rather than invoking an unversioned package.
  • Install the dependency locally using a committed lockfile and integrity metadata, then invoke the locked local binary.
  • Review and pin transitive dependencies; use automated dependency and provenance verification.
  • Require npm provenance or equivalent signed release attestations and verify package integrity before execution.
  • Publish or vendor the relevant source so the key-generation and transaction paths can be audited.
  • Execute wallet tooling in a restricted environment with minimal filesystem, network, and environment-variable access.
  • Separate key generation from network-enabled package execution where possible, using established offline cryptographic tooling.
  • Do not approve package upgrades automatically for software that handles signing keys or financial transactions.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:154
Finding

Agent-Controlled Valuation May Bypass Solana Spending Limits

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 154-174 and 252-258
Vulnerability Type: Untrusted financial accounting input
Risk Level: High

Vulnerable Code

typescript
// Transfer SOL
await program.methods
  .transferSol(new BN(amountUsdc), new BN(amountLamports))
  .accounts({
    wallet: walletPda,
    agent: agentKeypair.publicKey,
    recipient: recipientPubkey
  })
  .signers([agentKeypair])
  .rpc()

// Transfer SPL token
await program.methods
  .transferToken(new BN(tokenAmount), new BN(amountUsdc))
  .accounts({
    wallet: walletPda,
    agent: agentKeypair.publicKey,
    mint: mintPubkey,
    walletTokenAccount,
    recipientTokenAccount,
    tokenProgram: TOKEN_PROGRAM_ID
  })
  .signers([agentKeypair])
  .rpc()

The documented limit model also states:

markdown
| **SOL** | USD amount passed by agent | Shared USD daily + per-tx |

Technical Analysis

The documented Solana transaction interface takes both the asset quantity and its purported USD value from the signing agent. For SOL, amountLamports determines the transferred quantity while amountUsdc appears to determine spending-limit accounting. The document does not identify an on-chain oracle or another trusted validation mechanism that cryptographically binds these two values.

If the deployed program behaves as documented, a compromised or malicious agent could report a USD value lower than the actual market value of the transferred SOL. On-chain enforcement alone does not make a policy secure when the value used by that enforcement is supplied by the party whose spending is being constrained.

The same trust concern applies to the shown SPL-token method because tokenAmount and amountUsdc are independently supplied. However, the documentation separately describes SPL tokens as using per-token tracking, and the supplied artifact does not contain the Solana program implem ...[truncated 1366 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not trust a constrained agent to provide the USD valuation used to enforce its own spending limits.
  • Derive SOL valuation on-chain from a trusted oracle with explicit freshness, confidence-interval, and failure-mode checks.
  • Bind the transferred quantity and valuation in the program and reject values inconsistent with the trusted exchange rate.
  • Use conservative rounding so valuation truncation cannot reduce accounted spending.
  • When reliable price data is unavailable, fail closed or enforce a human-configured maximum quantity denominated directly in lamports.
  • For SPL tokens, enforce limits directly in token base units per verified mint, or use trusted per-mint price feeds rather than signer-supplied valuations.
  • Add tests covering zero, understated, stale, overflowed, and mismatched valuation inputs.
  • Publish and audit the Solana program source and IDL to verify that the deployed implementation contains these controls.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:23
Finding

Private Keys Exposed Through Standard Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23-59
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

bash
npx @agntos/agentwallet keygen
text
New Agent Keypairs
──────────────────────────
Base
  Address         0xB042...B7DC
  Private key     0x282a...b3a3

Solana
  Address         7Kp9...xR4v
  Private key     4vJ2...9mNq
bash
npx @agntos/agentwallet keygen --json
# { "base": { "address": "0x...", "privateKey": "0x...", "chain": "base" }, "solana": { "address": "7Kp...", "privateKey": "4vJ...", "chain": "solana" } }

Technical Analysis

The documented key-generation workflow prints newly generated private keys to standard output, including in machine-readable JSON. Standard output is frequently captured by terminal scrollback, CI/CD logs, orchestration systems, agent transcripts, shell wrappers, monitoring tools, or redirected files.

Although the document tells users to save keys securely and not log them, presenting plaintext private keys through stdout makes accidental retention likely. The JSON mode is particularly prone to automated capture because machine-readable output is commonly parsed or recorded by surrounding automation.

Attack Path

  1. A user or agent runs the documented keygen command in a logged terminal, CI job, managed agent environment, or orchestrated process.
  2. The generated private key is written in plaintext to standard output.
  3. Terminal history, job logs, observability tooling, transcripts, or output redirection retains the key.
  4. An attacker with read access to that retained output extracts the private key.
  5. The attacker imports the key and signs transactions as the corresponding agent.
  6. The attacker exercises all wallet authority available to that signer, subject to controls genuinely enforced by the wallet contracts or programs.

Impact Assessment

Disclos ...[truncated 431 chars]

Remediation
View remediation

Remediation Suggestions

  • Avoid printing private keys to standard output by default.
  • Write generated keys directly to an encrypted keystore, operating-system keychain, hardware-backed signer, or secrets manager.
  • Return only public addresses and opaque secret identifiers in normal and JSON output.
  • If export is unavoidable, require an explicit interactive opt-in and write to a newly created file with restrictive permissions rather than stdout.
  • Prevent secret values from entering agent transcripts, CI logs, telemetry, crash reports, and shell tracing.
  • Clearly document secure backup and rotation procedures.
  • Rotate any key that may have appeared in retained logs, and securely delete those records where feasible.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (30)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill repeatedly instructs users to run npx @agntos/agentwallet without pinning a specific package version. Because npx fetches the latest published package at execution time, a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution on the operator's machine, including theft of wallet private keys or transaction manipulation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This command uses unpinned npx execution for wallet key generation, which is especially sensitive because the tool handles newly created private keys. If the package supply chain is compromised, an attacker could exfiltrate generated keys at creation time, completely defeating the non-custodial security model.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The Solana-only key generation example also fetches and executes the latest package version at runtime. Since this operation processes secret key material, a malicious package update could steal the private key immediately or return attacker-controlled output.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The JSON key generation example combines secret-bearing output with unpinned npx execution. A supply-chain compromise here is particularly dangerous because the package can both generate and serialize private keys in machine-readable form, making automated exfiltration trivial.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This command dynamically executes the latest package while producing a Solana private key in JSON output. The combination of unpinned execution and machine-readable secret output materially increases risk of silent key theft if the package or registry path is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

This wallet creation command uses unpinned npx, allowing the fetched code to change over time. A malicious or compromised release could create wallets controlled by an attacker, alter setup URLs, or misdirect funds during onboarding.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The unmanaged wallet creation path is executed via unpinned npx, so the code responsible for provisioning a fully autonomous wallet can change unexpectedly. In a compromise scenario, an attacker could provision malicious configurations with no human approval layer to catch it.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This Base-only wallet creation example relies on unpinned live package execution. While less sensitive than key generation, it still affects wallet initialization and could misconfigure or redirect the resulting wallet if the package supply chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The Solana-only create command also trusts the latest package version at runtime. A malicious update could derive incorrect PDAs, return attacker-controlled setup links, or otherwise poison wallet initialization before the user notices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation describes unmanaged wallets as 'Fully autonomous' but does not pair that statement with an equally explicit warning that this removes human approval/passkey control over transactions. In the context of agent wallets handling real funds, this can cause operators to enable a materially riskier mode without understanding that compromised agents or faulty automation may spend funds without human intervention.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

Using unpinned npx for a status command is still a supply-chain risk, even if it is less sensitive than key generation or wallet creation. A compromised package could execute arbitrary code on the host, inspect environment variables, or falsify wallet state shown to the operator.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

This auto-detected Solana status command executes the latest package without version pinning. Even read-only looking commands can become arbitrary code execution vectors if the package or distribution path is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
80% confidence
Finding

The JSON status example uses the same unpinned package pattern and could misreport wallet data or leak local secrets if a compromised version is fetched. Machine-readable output can also make automated misuse easier in scripted environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

This limits-adjustment command uses unpinned npx even though it initiates authorization-sensitive workflow by generating a URL for human approval. A malicious package could substitute attacker-controlled approval URLs or modify the requested limits.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The token-limit administrative command is executed through an unpinned package. A compromised release could silently set unsafe per-token limits, trick users about what was configured, or manipulate data before approval.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The pause command is safety-critical, yet it relies on unpinned transient code execution. In an incident, a compromised package could block or spoof emergency actions, delaying containment of malicious transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This command list entry advertises unpinned key generation. Because users may copy-paste from the consolidated command reference, the same supply-chain risk applies: arbitrary code execution with immediate exposure of generated private keys.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The Base-only key generation reference also omits version pinning, exposing users to silent changes in the executable they run. In the context of wallet creation, compromise of this step can directly lead to asset theft.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The Solana key generation reference repeats the same unpinned package execution pattern. Since the tool handles raw private keys, supply-chain compromise here is a direct path to total wallet compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

This managed wallet creation reference uses unpinned npx, allowing the wallet provisioning logic to drift or be maliciously replaced. In a financial-wallet context, that can lead to incorrect ownership setup or attacker-controlled onboarding links.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The Base-only managed wallet creation reference likewise relies on runtime fetching of the latest package. That creates unnecessary supply-chain exposure during wallet initialization, a trust-sensitive operation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The Solana managed wallet creation reference repeats the unpinned execution pattern in a provisioning workflow. A compromised package could derive or present incorrect addresses or setup metadata and mislead the operator before funding.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This unmanaged wallet creation command is especially risky because it combines unpinned execution with a no-human-approval mode. If the fetched package is malicious, there may be no human control layer to catch dangerous setup before funds are deposited.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
79% confidence
Finding

Although a status command is lower sensitivity, it still uses unpinned npx and therefore executes arbitrary remote package code on the host. In operational contexts, even read-only invocations can leak secrets or provide false assurance via manipulated output.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

This limits command initiates governance over spend controls but is executed via an unpinned package. A compromised release could manipulate requested limits or generate fraudulent approval flows, increasing spending authority unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.