ClawHub
Back to skill

Security audit

Para Wallet

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Para wallet API guide, but it needs review because it enables agents to create wallets and sign raw blockchain payloads without clear safeguards.

Install only if you understand that this gives an agent instructions to create wallets and request signatures through your Para account. Prefer direct-copy installation over the global npm command, protect and scope the API key, and require explicit human review of the chain, wallet, payload, destination, amount, and contract/program action before any signing request.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:16
Finding

Unpinned Global npm Package Installation with Package-Identity Mismatch

Content
View full analysis

Vulnerability Details

File Location: README.md, line 16
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code

bash
npm i -g clawdhub && clawdhub install para-wallet

Technical Analysis

The installation instructions execute the latest available version of the third-party clawdhub npm package without an exact version, lockfile, or integrity verification. Because npm packages may execute lifecycle scripts during installation, installing an untrusted or compromised release can immediately execute code with the privileges of the user running npm.

There is also a package-identity inconsistency: the project describes and links “ClawhHub” and clawhhub.com, while the installed npm package and executable are named clawdhub. This mismatch increases the risk that users may install a typographically similar, unintended, or spoofed package.

The -g flag expands the consequences by installing the package globally and exposing its executable through the user's global command path.

Attack Path

  1. An attacker publishes or compromises a release under the referenced clawdhub npm package name.
  2. The malicious release includes an npm lifecycle script or a modified command-line executable.
  3. A user follows the documented command without verifying the package identity, version, provenance, or integrity.
  4. npm resolves the mutable package version and installs it globally.
  5. Any lifecycle script executes during installation with the invoking user's privileges.
  6. The chained clawdhub install para-wallet command then executes the installed binary, providing a second opportunity for arbitrary malicious behavior.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the account running the installation command. The attacker may access files and environment variables available to that account, including potentially configured API credent ...[truncated 399 chars]

Remediation
View remediation

Remediation Suggestions

  1. Confirm the canonical package identity and correct the discrepancy between “ClawhHub” and clawdhub.
  2. Pin the dependency to a reviewed exact version, for example clawdhub@X.Y.Z, rather than resolving the latest mutable release.
  3. Publish the canonical npm registry page and source repository so users can verify package ownership and provenance.
  4. Provide integrity or signature verification instructions where supported.
  5. Avoid global installation where possible. Prefer a locally pinned development dependency or an isolated package runner with an explicit version.
  6. Audit npm lifecycle scripts and package contents before recommending the package.
  7. Prefer the documented direct-copy installation method for this Markdown-only skill when the package manager is not required.
  8. Advise users not to run the installation command with sudo or another elevated account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README promotes creating wallets and signing arbitrary data but does not warn users that signing can authorize irreversible blockchain transactions or approvals. In an agent-skill context, this omission is more dangerous because autonomous or semi-autonomous agents may treat signing as a routine API action and execute high-impact transfers, approvals, or malicious payloads without adequate human review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill enables creation of blockchain wallets and signing of arbitrary data without prominently warning that these operations can authorize irreversible on-chain actions or identity-binding signatures. In an agent context, this increases the risk that a user or downstream agent invokes signing on unreviewed payloads, leading to fund movement, approval abuse, or unintended authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

EVM Example

bash
curl -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Even though the matched item is the URL reference, in context it points to a high-risk raw-signing operation. The danger comes from encouraging remote signing of opaque data in a blockchain wallet skill, where signatures may authorize irreversible or security-sensitive actions.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Sign a message hash (e.g., a keccak256 hash of a transaction):

bash
curl -X POST https://api.beta.getpara.com/v1/wallets/0a1b2c3d-4e5f-6789-abcd-ef0123456789/sign-raw \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Even though the matched item is the URL reference, in context it points to a high-risk raw-signing operation. The danger comes from encouraging remote signing of opaque data in a blockchain wallet skill, where signatures may authorize irreversible or security-sensitive actions.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Sign a message hash (e.g., a keccak256 hash of a transaction):

bash
curl -X POST https://api.beta.getpara.com/v1/wallets/0a1b2c3d-4e5f-6789-abcd-ef0123456789/sign-raw \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example signs a serialized Solana transaction as raw data with no review or policy checks. In context, that can directly authorize asset transfers or program interactions, so the lack of validation and consent guidance makes it materially risky.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Sign a serialized Solana transaction:

bash
curl -X POST https://api.beta.getpara.com/v1/wallets/aabbccdd-1122-3344-5566-778899aabbcc/sign-raw \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The full example's remote calls are not harmful merely because they are external, but the workflow automates security-sensitive wallet operations end-to-end without friction. In context, this can promote unsafe operational patterns for agents handling real identities and assets.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

bash
# 1. Create an EVM wallet
RESPONSE=$(curl -s -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The full example's remote calls are not harmful merely because they are external, but the workflow automates security-sensitive wallet operations end-to-end without friction. In context, this can promote unsafe operational patterns for agents handling real identities and assets.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

bash
# 1. Create an EVM wallet
RESPONSE=$(curl -s -X POST https://api.beta.getpara.com/v1/wallets \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The referenced endpoint is the raw-signing API used in an example that signs an opaque hex blob. In this skill's context, that is dangerous because agents may sign attacker-supplied payloads that have real financial or authorization consequences.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
done

# 3. Sign data
SIGNATURE=$(curl -s -X POST https://api.beta.getpara.com/v1/wallets/$WALLET_ID/sign-raw \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{"data": "0x48656c6c6f"}')

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The referenced endpoint is the raw-signing API used in an example that signs an opaque hex blob. In this skill's context, that is dangerous because agents may sign attacker-supplied payloads that have real financial or authorization consequences.

Content

Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.

md
done

# 3. Sign data
SIGNATURE=$(curl -s -X POST https://api.beta.getpara.com/v1/wallets/$WALLET_ID/sign-raw \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $PARA_API_KEY" \
  -d '{"data": "0x48656c6c6f"}')

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The setup section instructs users to export a secret API key but gives no handling guidance such as avoiding commits, logs, shared shells, or prompt exposure. In an agent environment, secrets are especially easy to leak through tool traces, chat history, misconfigured environments, or generated code, which could let an attacker abuse the Para account to create wallets or request signatures.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill supports EVM and Solana chains via three REST endpoints. However, the file documents four endpoint paths (POST /v1/wallets, GET /v1/wallets/{walletId}, POST /v1/wallets/{walletId}/sign-raw, plus the documented production and beta base URLs are not the issue) and also states support for COSMOS in request/response fields, which exceeds the stated EVM/Solana-only scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The overview states the skill is ideal for agents that need to create wallets and sign transactions, implying a transaction-signing capability. Later, the only implemented signing endpoint is POST /v1/wallets/{walletId}/sign-raw, described as signing arbitrary data, which is not the same as a dedicated transaction-signing operation and can be broader or semantically different.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.