OpenClaw 1ly Payments

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:00 AM UTC
• Version: 1.0.4

Overview

This payments skill is coherent, but it asks users to connect wallet signing authority to externally installed tooling and includes risky private-key handling guidance.

Review this carefully before installing. Use a dedicated low-value wallet, prefer managed or external signing over raw private keys, avoid storing keys in OpenClaw config or shell history, pin and review the installed packages where possible, and keep autonomous spending limits very small.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17
• Finding: Unverified Third-Party Packages Are Downloaded and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 17-24 **Vulnerability Type**: Supply-chain exposure through unpinned and inadequately verified dependencies **Risk Level**: High **Vulnerable Code:** ```bash npm install -g mcporter mcporter config add 1ly --command "npx @1ly/mcp-server@0.1.6" ``` ```text Verify package integrity: `npm view @1ly/mcp-server dist.integrity` ``` ### Technical Analysis The setup instructions globally install `mcporter` without pinning its version and configure it to execute an externally retrieved npm package through `npx`. Although `@1ly/mcp-server` is pinned to version `0.1.6`, its executable content and transitive dependencies are obtained from an external registry at installation or invocation time. The suggested integrity check only displays the registry-provided `dist.integrity` value. It does not compare the downloaded artifact against a trusted digest obtained through an independent channel. If the registry package, publisher account, or distribution metadata is compromised, both the package and its displayed integrity metadata may be controlled by the same attacker. Because the MCP server operates in an environment containing wallet paths, private keys, API credentials, RPC configuration, and spending limits, malicious dependency code could access highly sensitive payment material. ### Attack Path 1. An attacker compromises the npm publisher account, package release, registry delivery path, or a relevant dependency. 2. The user follows the documented setup and runs `npm install -g mcporter`, retrieving an unpinned current release. 3. The user invokes the configured MCP server, causing `npx` to retrieve and execute `@1ly/mcp-server@0.1.6` and its dependency chain. 4. Malicious package initialization or runtime code executes with the user's local privileges. 5. The code reads accessible environment variables, wallet files, API keys, or OpenClaw configuration and m ...[truncated 702 chars]
• Remediation: ## Remediation Suggestions - Pin `mcporter` to an explicitly reviewed version rather than installing the latest mutable release. - Prefer a project-local installation governed by a committed lockfile over a global installation. - Lock and review transitive dependencies, and use deterministic installation commands such as `npm ci`. - Verify package artifacts against expected hashes or signatures published through an independent, trusted channel. Merely displaying registry metadata is insufficient. - Run the MCP server in a sandbox with restricted filesystem, network, process, and environment access. - Expose only the credentials required for the selected operation, rather than passing all wallet and seller credentials into the same process. - Use a dedicated low-value wallet with strict external transaction controls and monitoring. - Review or vendor the executable package before deploying it in an environment capable of signing financial transactions.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44
• Finding: Raw Wallet Private Keys Are Recommended in Environment Variables## Vulnerability Details **File Location**: `SKILL.md`, lines 44-49 **Vulnerability Type**: Plaintext exposure of wallet private keys through process environments and configuration **Risk Level**: High **Vulnerable Code:** ```text Wallet file rules: - Wallet files must be in the user home directory or `/tmp`. Paths outside are rejected for security. - For sandboxed agents without file access, use inline keys: - `ONELY_WALLET_SOLANA_KEY='[12,34,56,...]'` - `ONELY_WALLET_EVM_KEY='0x...'` - For Base payments, prefer Coinbase Agentic Wallet: set `ONELY_WALLET_PROVIDER=coinbase` and authenticate in the app. Do not use raw EVM keys unless required. ``` ### Technical Analysis The instructions explicitly recommend placing raw Solana and EVM private keys in environment variables for sandboxed agents. Environment variables are plaintext process data and are not a dedicated secret-storage mechanism. Depending on the operating environment, they may be exposed through inherited child-process environments, process inspection, diagnostic output, crash reports, shell history, configuration serialization, debugging tools, or accidental logging. The project also demonstrates placing skill environment values in `~/.openclaw/openclaw.json`. If users apply the same pattern to inline keys, wallet secrets may persist unencrypted in a configuration file. A private key grants signing authority rather than merely identifying an account, so disclosure can permit irreversible blockchain transactions without further authentication. ### Attack Path 1. A user follows the inline-key guidance and assigns a Solana or EVM private key to an environment variable or stores it in the OpenClaw skill configuration. 2. OpenClaw launches the MCP server or another child process with the secret present in its inherited environment. 3. A compromised dependency, local process with sufficient access, diagnostic tool, log collector, crash handler, or configuratio ...[truncated 851 chars]
• Remediation: ## Remediation Suggestions - Remove the recommendation to pass raw wallet private keys through environment variables. - Use a hardware wallet, OS keychain, managed secret store, or isolated signing service that does not expose private-key material to the agent process. - Prefer the documented managed-wallet provider for supported EVM operations and require explicit transaction policies at the signer. - For Solana operations, use a constrained external signer or dedicated low-value wallet rather than a primary wallet key. - If environment-based delivery is unavoidable, inject secrets only into the exact process that needs them, prevent unnecessary child-process inheritance, disable environment logging, and clear values promptly. - Never place raw keys in shell command lines, shell history, source-controlled files, general OpenClaw configuration, or diagnostic reports. - Apply restrictive permissions to any unavoidable wallet file, encrypt it at rest, and keep it outside shared temporary directories. - Enforce spending and destination controls at the wallet or signing-service layer so that compromise of the application cannot bypass application-level budgets. - Rotate any private key that may already have been exposed through environment variables, logs, or configuration backups.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- Auto-spend only when `ONELY_BUDGET_PER_CALL` and `ONELY_BUDGET_DAILY` are set and within limits.
- Never spend above budget limits.
- Keep wallet keys local; do not upload keys.
- Secure wallet file permissions: `chmod 600 /path/to/wallet.json`

## Tool inputs (current schema)
Use `mcporter list 1ly --schema` if tool names or parameters differ.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.