ClawHub
Back to skill

Security audit

KarmaBank

Security checks for vulnerabilities and agentic risk

Overview

KarmaBank is coherent as a USDC credit demo, but it asks users to install mutable wallet-related dependencies and exposes financial and wallet actions without enough scoping or safety guidance.

Review this before installing. Use only testnet or throwaway credentials, avoid running npm install where wallet/API secrets are present, inspect or vendor the missing ../skills/circle-wallet dependency, and do not let an agent run borrow, repay, or wallet creation commands without explicit human confirmation of amount, account, network, and environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:29
Finding

Dependency Installation Uses Mutable Versions and an Unreviewed External Local Package

Content
View full analysis

Vulnerability Details

File Location: package.json:29-44; installation is directed by SKILL.md:14-17 and README.md:25-30
Vulnerability Type: Supply-chain risk from unpinned and externally sourced dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:14-17:

bash
# Install
npm install
npm run build

README.md:25-30:

bash
## Installation

```bash
cd agent-credit-system
npm install
text

`package.json:29-44`:

```json
"devDependencies": {
  "@types/jest": "^30.0.0",
  "@types/node": "^25.2.0",
  "jest": "^30.2.0",
  "ts-jest": "^29.4.6",
  "typescript": "^5.9.3"
},
"dependencies": {
  "@circle-fin/developer-controlled-wallets": "^10.1.0",
  "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet",
  "@types/uuid": "^10.0.0",
  "axios": "^1.13.4",
  "commander": "^14.0.3",
  "dotenv": "^17.2.3",
  "node-forge": "^1.3.3",
  "uuid": "^13.0.0"
}

Technical Analysis

The documented installation process instructs users or agents to execute npm install, but the artifact contains no dependency lockfile. Most dependencies use caret version ranges, allowing npm to resolve versions other than those represented when the package was originally prepared or reviewed.

The dependency @circle/openclaw-wallet-skill is loaded through file:../skills/circle-wallet. This path is outside the audited project directory, and the referenced package was not included in the supplied artifact. Its source code, transitive dependencies, and npm lifecycle scripts therefore cannot be verified.

npm installations can execute dependency lifecycle scripts with the permissions of the user running npm. Because this project concerns cryptocurrency wallets and documents Circle API credentials, malicious or compromised dependency code could potentially access sensitive environment variables and files available to that process.

No evidence establishes th ...[truncated 1623 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete source of ../skills/circle-wallet within the auditable project boundary, or replace the external file dependency with an explicitly reviewed and integrity-controlled package.
  2. Pin security-sensitive production dependencies to exact reviewed versions rather than caret ranges.
  3. Generate, review, and commit package-lock.json.
  4. Use npm ci in documented installation and CI procedures to enforce the committed dependency graph.
  5. Review direct and transitive dependency lifecycle scripts before installation.
  6. Use npm install --ignore-scripts where lifecycle scripts are unnecessary, enabling only specifically reviewed build steps afterward.
  7. Run installation and builds under an unprivileged account with a restricted environment that does not contain wallet or API credentials.
  8. Add dependency auditing, provenance verification, and automated vulnerability scanning to CI.
  9. Document why wallet and cryptographic dependencies are required and ensure that credential-bearing runtime environments are separated from dependency installation environments.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (17)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file describes safety-relevant state-changing operations: borrowing and repaying USDC, and the architecture later notes a file-backed JSON ledger. The README shows examples using --yes, which implies skipping confirmation, but it does not provide any explicit warning that these commands will mutate persisted ledger state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises commands that can create Circle wallets and borrow or repay USDC, but it does not clearly warn users that these actions may affect real wallets, credentials, account state, or funds if configured against non-mock environments. In an agent setting, missing safety disclosures can lead to unintended financial operations or exposure of sensitive API-backed actions, especially because the configuration section explicitly references real Circle credentials.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json
"author": "",
  "license": "ISC",
  "devDependencies": {
    "@types/jest": "^30.0.0",
    "@types/node": "^25.2.0",
    "jest": "^30.2.0",
    "ts-jest": "^29.4.6",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 31)May include surrounding context.

json
"license": "ISC",
  "devDependencies": {
    "@types/jest": "^30.0.0",
    "@types/node": "^25.2.0",
    "jest": "^30.2.0",
    "ts-jest": "^29.4.6",
    "typescript": "^5.9.3"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 32)May include surrounding context.

json
"devDependencies": {
    "@types/jest": "^30.0.0",
    "@types/node": "^25.2.0",
    "jest": "^30.2.0",
    "ts-jest": "^29.4.6",
    "typescript": "^5.9.3"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 33)May include surrounding context.

json
"@types/jest": "^30.0.0",
    "@types/node": "^25.2.0",
    "jest": "^30.2.0",
    "ts-jest": "^29.4.6",
    "typescript": "^5.9.3"
  },
  "dependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 34)May include surrounding context.

json
"@types/node": "^25.2.0",
    "jest": "^30.2.0",
    "ts-jest": "^29.4.6",
    "typescript": "^5.9.3"
  },
  "dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
84% confidence
Finding

This skill interacts with developer-controlled wallets and likely handles financial operations, so allowing automatic upgrades of a sensitive runtime dependency increases supply-chain risk materially. A malicious or compromised upstream release could affect wallet management, transaction signing, or token transfer logic without any code change in this repository.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json
"typescript": "^5.9.3"
  },
  "dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",
    "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet",
    "@types/uuid": "^10.0.0",
    "axios": "^1.13.4",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 39)May include surrounding context.

json
"dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",
    "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet",
    "@types/uuid": "^10.0.0",
    "axios": "^1.13.4",
    "commander": "^14.0.3",
    "dotenv": "^17.2.3",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
88% confidence
Finding

axios is a runtime network client, and this skill likely reaches external services for credit or wallet operations. Leaving it unpinned increases exposure to supply-chain drift and makes it harder to verify whether the installed version is affected by known issues such as SSRF-related bugs or future malicious releases.

Content

Scanner excerpt · package.json (reported line 40)May include surrounding context.

json
"@circle-fin/developer-controlled-wallets": "^10.1.0",
    "@circle/openclaw-wallet-skill": "file:../skills/circle-wallet",
    "@types/uuid": "^10.0.0",
    "axios": "^1.13.4",
    "commander": "^14.0.3",
    "dotenv": "^17.2.3",
    "node-forge": "^1.3.3",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The manifest uses an unpinned axios version even though the package has multiple known advisories, so the actual installed release may be vulnerable and cannot be verified from this file alone. In a skill that may contact external APIs for wallet, credit, or user data operations, an affected HTTP client can enable SSRF, credential leakage, or response manipulation with direct security consequences.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json
"@circle/openclaw-wallet-skill": "file:../skills/circle-wallet",
    "@types/uuid": "^10.0.0",
    "axios": "^1.13.4",
    "commander": "^14.0.3",
    "dotenv": "^17.2.3",
    "node-forge": "^1.3.3",
    "uuid": "^13.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 42)May include surrounding context.

json
"@types/uuid": "^10.0.0",
    "axios": "^1.13.4",
    "commander": "^14.0.3",
    "dotenv": "^17.2.3",
    "node-forge": "^1.3.3",
    "uuid": "^13.0.0"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

node-forge is a security-sensitive cryptography library, and unpinned versions are more dangerous in a financial skill because cryptographic behavior, certificate validation, or parsing logic may change across releases. In wallet or lending flows, compromise or regression in a crypto library can have outsized effects on confidentiality, integrity, or transaction trust.

Content

Scanner excerpt · package.json (reported line 43)May include surrounding context.

json
"axios": "^1.13.4",
    "commander": "^14.0.3",
    "dotenv": "^17.2.3",
    "node-forge": "^1.3.3",
    "uuid": "^13.0.0"
  }
}

Unverifiable Dependency: node-forge has 15 known advisory(ies) (CVE-2026-33896 (Forge has a basicConstraints bypass in its certificate chain verification (RFC 5); CVE-2022-24773 (Improper Verification of Cryptographic Signature in `node-forge`); CVE-2025-66031 (node-forge has ASN.1 Unbounded Recursion) +12 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

node-forge has numerous security advisories and the manifest does not pin the version, making it impossible to confirm whether the installed build is safe. Because this skill is in a financial context and may rely on cryptographic operations or certificate handling, use of a vulnerable crypto library could undermine authentication, secure communications, or signing-related trust boundaries.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 44)May include surrounding context.

json
"commander": "^14.0.3",
    "dotenv": "^17.2.3",
    "node-forge": "^1.3.3",
    "uuid": "^13.0.0"
  }
}

Unverifiable Dependency: uuid has 1 known advisory(ies) (CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.