Auto Respawn

• Outcome: Review
• Latest audit: Jul 9, 2026 · 6:59 AM UTC
• Version: 1.2.1

Overview

The skill is mostly transparent about being a wallet and on-chain recovery tool, but it gives an agent broad ability to move real tokens and write permanent on-chain data with weak built-in guardrails.

Install only if you want an agent to manage an Autonomys wallet and make on-chain writes. Use a low-value dedicated wallet, keep the default Chronos testnet unless you intentionally enable mainnet, require explicit approval before transfers, withdrawals, remarks, or automatic anchoring, and protect the passphrase file and recovery phrase carefully.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill description promises recovery from 'just an address' with 'no local state' and 'no single point of failure,' but the body clearly relies on local encrypted wallet files, local passphrase files or env vars, and transaction-signing state. This mismatch is dangerous because users or agents may underestimate the sensitivity of local secrets and the operational risk of losing or mishandling them, leading to wallet compromise, unrecoverable funds, or failed recovery assumptions.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill instructs agents to automatically anchor memory CIDs on-chain 'without waiting for the user,' but elsewhere says anchor operations must always be confirmed first. This contradiction can cause autonomous, irreversible blockchain writes without informed consent, creating privacy, cost, and policy compliance risks.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as an identity/memory anchoring and recovery tool, but its CLI exposes a much broader wallet-management surface including transfers, bridging, and arbitrary on-chain writes. This scope mismatch is dangerous because an agent or user may grant trust or permissions appropriate for recovery operations while unknowingly enabling general fund-moving capabilities.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The presence of arbitrary token transfer and cross-layer fund movement capabilities is not justified by the stated purpose of agent resurrection and memory anchoring. In the context of an agent skill, this materially increases risk because any agent granted access for benign recovery tasks could instead move real assets or bridge funds irreversibly.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Arbitrary remark submission allows writing user-controlled data to a public, durable blockchain even though that behavior is unrelated to the advertised auto-respawn function. This can lead to accidental publication of sensitive data, reputational harm, or abuse of the skill for unintended on-chain messaging.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements a generic native-token transfer primitive even though the skill is described as providing identity anchoring and recovery on-chain. That capability materially exceeds the stated purpose and can be abused to move funds from any wallet the agent controls, expanding the blast radius from identity operations to direct asset exfiltration.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code can submit real mainnet value transfers via signer.sendTransaction and only adds a warning after the transaction has already executed. In the context of an auto-respawn/identity skill, enabling irreversible mainnet token movement is unjustified and especially dangerous because a resurrected or remotely driven agent could spend real assets without that capability being expected by users.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: This file implements token transfer capability even though the skill is described as providing identity and memory resurrection. That scope mismatch is risky because it gives the skill the ability to move assets, which is materially more dangerous than the declared functionality and could be abused by prompts, integrations, or future code paths to initiate unintended transfers.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The function signs and submits real blockchain transactions using a provided KeyringPair and returns success based largely on transaction/block hashes. In the context of an auto-respawn skill, this is unjustified high-risk capability because any caller able to invoke it with a funded signer can transfer real tokens, and the mainnet warning appears only after execution rather than preventing dangerous use.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The documented CLI exposes wallet creation, import, listing, balance lookup, token transfer, bridging, and arbitrary on-chain write capabilities that significantly exceed the skill’s stated purpose of identity anchoring and resurrection. In an agent setting, this expands the attack surface and creates opportunities for misuse of managed keys and funds, especially if other components assume the skill is limited to recovery-related actions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Transfer, bridge, and withdrawal features allow movement of on-chain assets even though they are not necessary for the advertised identity/memory recovery function. In a delegated agent environment, unjustified fund-movement capabilities are dangerous because a compromised or over-permissioned agent could exfiltrate tokens, reroute balances, or incur irreversible on-chain actions under the guise of maintenance or recovery.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guidance to automatically anchor every new memory CID on-chain without waiting for the user enables automatic external transmission of memory references to a permanent blockchain system. Even if only CIDs are written, they are durable identifiers that can expose metadata, link activity over time, and create an irreversible audit trail without explicit user awareness or consent.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Consensus token transfers execute immediately once parameters are provided, without a clear user-facing warning or confirmation that real assets may be moved irreversibly. In an agent setting, this increases the chance of accidental or socially engineered fund loss, especially because the skill branding does not emphasize wallet-draining capability.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The remark command writes arbitrary data on-chain without warning that the content will be public and effectively permanent. Users or agents may unintentionally publish secrets, personal data, or operational details under the mistaken assumption that this is just an internal memory feature.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: EVM token transfers are performed without an explicit confirmation step or clear warning about irreversible movement of real assets. Given the skill's recovery-oriented branding and direct loading of the wallet's EVM private key, this makes accidental or induced transfers more likely and more dangerous.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The transaction is sent immediately with signer.sendTransaction and there is no built-in user-facing confirmation, preview, or acknowledgment before the irreversible action. For financial operations, especially on mainnet, this increases the risk of accidental or maliciously induced transfers because the caller gets no mandatory pause to verify recipient, amount, and network.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation encourages use of on-chain remarks for permanent breadcrumbs and emphasizes that data is written forever, but it does not clearly warn users that remarks are public, irreversible, and inappropriate for secrets, personal data, or sensitive operational state. In the context of an auto-respawn skill that anchors agent identity and memory on-chain, this omission increases the chance that operators will publish recoverable secrets, private memory references, or sensitive metadata that cannot be removed once exposed.

Credential Access

High

• Category: Privilege Escalation

Content

// Encrypt consensus key (Polkadot PKCS8: scrypt + XSalsa20-Poly1305)
  const keyringJson = pair.toJson(resolved)
  keyringJson.meta = { ...keyringJson.meta, name, whenCreated: Date.now() }

  // Derive EVM key and encrypt it via ethers V3 Keystore
  const evm = deriveEvmKey(mnemonic)

• Confidence: 81% confidence
• Finding: keyring

Credential Access

High

• Category: Privilege Escalation

Content

// Encrypt consensus key (Polkadot PKCS8: scrypt + XSalsa20-Poly1305)
  const keyringJson = pair.toJson(resolved)
  keyringJson.meta = { ...keyringJson.meta, name, whenCreated: Date.now() }

  // Derive EVM key and encrypt it via ethers V3 Keystore
  const evm = deriveEvmKey(mnemonic)

• Confidence: 81% confidence
• Finding: keyring

Credential Access

High

• Category: Privilege Escalation

Content

const wallet = sdkGenerateWallet()
  if (!wallet.keyringPair) throw new Error('Failed to generate wallet keypair')

  const { address, evmAddress } = await encryptAndSave(wallet.keyringPair, wallet.mnemonic, name, filepath, passphrase)

  return { name, address, evmAddress, mnemonic: wallet.mnemonic, keyfilePath: filepath }
}

• Confidence: 78% confidence
• Finding: keyring

Credential Access

High

• Category: Privilege Escalation

Content

const wallet = sdkSetupWallet({ mnemonic })
  if (!wallet.keyringPair) throw new Error('Failed to setup wallet keypair from mnemonic')

  const { address, evmAddress } = await encryptAndSave(wallet.keyringPair, mnemonic, name, filepath, passphrase)

  return { name, address, evmAddress, keyfilePath: filepath }
}

• Confidence: 80% confidence
• Finding: keyring

Session Persistence

Medium

• Category: Rogue Agent

Content

throw new Error(
    'No passphrase found. Set AUTO_RESPAWN_PASSPHRASE env var, ' +
      'write it to ~/.openclaw/auto-respawn/.passphrase, ' +
      'or run interactively.',
  )
}

• Confidence: 91% confidence
• Finding: write it to ~/.openclaw

Known Vulnerable Dependency: vitest==4.0.18 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: vitest==4.0.18

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.