LLM Wallet - x402 stabelcoin payments on Polygon

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 AM UTC
• Version: 1.0.0

Overview

This skill is openly for crypto wallet payments, but it relies on an unpinned external wallet package for sensitive money-handling operations.

Review this skill carefully before installing. Use only a dedicated testnet wallet or a low-balance wallet, pin and verify the llm-wallet-mcp package before running it, avoid global or elevated installs, keep private keys and WALLET_ENCRYPTION_KEY out of chats and repositories, and approve payments only after checking the destination URL, amount, network, and recipient.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Unpinned Third-Party Wallet Package Can Introduce Supply-Chain Code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (37)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

Quick Start

1. Create Wallet

bash

llm-wallet create --label "my-agent-wallet"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

User: "Yes"

Agent executes: llm-wallet pay "https://api.weather.com/current?location=London"

text

## Usage in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 144)May include surrounding context.

User: "Yes"

Agent executes: llm-wallet pay "https://api.weather.com/current?location=London"

text

## Usage in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 154)May include surrounding context.

User: "Yes"

Agent executes: llm-wallet pay "https://api.weather.com/current?location=London"

text

## Usage in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 291)May include surrounding context.

User: "Yes"

Agent executes: llm-wallet pay "https://api.weather.com/current?location=London"

text

## Usage in OpenClaw

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 99)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 105)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 170)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 174)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 178)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 194)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 292)May include surrounding context.

md

User: Yes, approved

Agent: [Executes: llm-wallet pay "https://api.translate.com/v1?text=hello&to=es"]
       Translation: "hola"
       Payment completed: 0.002 USDC
       Transaction: 0xabc123...

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run npx llm-wallet-mcp without pinning a version, which allows execution of whatever package version is current at install time. This creates a supply-chain risk: a malicious or compromised future release could be fetched and executed unexpectedly in an environment that may have access to wallet data or secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 90)May include surrounding context.

bash

# Make payment to weather API
llm-wallet pay "https://api.weatherapi.com/v1/current.json?q=London" \
  --method GET

# Response:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 123)May include surrounding context.

bash

# Make POST request with JSON body
llm-wallet pay "https://api.image-gen.com/v1/generate" \
  --method POST \
  --body '{"prompt": "sunset over ocean", "size": "1024x1024"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 242)May include surrounding context.

API Not Responding

bash

llm-wallet pay "https://api.down-service.com/endpoint"
# Error: Network timeout after 3 retry attempts
#        Service may be temporarily unavailable
#        Try again later or check: https://status.down-service.com

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 261)May include surrounding context.

Shows mainnet balance

Make mainnet payment

llm-wallet pay "https://api.mainnet-service.com/endpoint"

text

### Multiple Wallets

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 293)May include surrounding context.

md

# Register multiple APIs
llm-wallet register-api "https://api.weather.com/v1" --name weather
llm-wallet register-api "https://api.translate.com/v1" --name translate
llm-wallet register-api "https://api.image.com/v1" --name image_gen

# List all registered
llm-wallet list-apis

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation recommends running an unpinned package via npx llm-wallet-mcp, which fetches and executes whatever version is current at invocation time. In a wallet-management context, that creates a meaningful supply-chain risk: a compromised or maliciously updated package could gain access to wallet material, alter payment behavior, or exfiltrate secrets.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/wallet-setup.md (reported line 21)May include surrounding context.

First Time Setup

1. Create Wallet

bash

llm-wallet create --label "my-agent-wallet"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The mainnet funding section warns that real money is involved but does not explicitly tell users to verify destination address, network, and the irreversibility of transfers. In a crypto wallet setup guide, that omission is safety-relevant because users may permanently lose funds by sending assets to the wrong address, wrong chain, or untrusted intermediary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

"network": "polygon-amoy", "maxAmountRequired": "1000", // 0.001 USDC "payTo": "0xCA3953e536bDA86D1F152eEfA8aC7b0C82b6eC00", "resource": "https://api.example.com/weather" }] }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

"network": "polygon-amoy", "maxAmountRequired": "1000", // 0.001 USDC "payTo": "0xCA3953e536bDA86D1F152eEfA8aC7b0C82b6eC00", "resource": "https://api.example.com/weather" }] }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

"network": "polygon-amoy", "maxAmountRequired": "1000", // 0.001 USDC "payTo": "0xCA3953e536bDA86D1F152eEfA8aC7b0C82b6eC00", "resource": "https://api.example.com/weather" }] }

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

"network": "polygon-amoy", "maxAmountRequired": "1000", // 0.001 USDC "payTo": "0xCA3953e536bDA86D1F152eEfA8aC7b0C82b6eC00", "resource": "https://api.example.com/weather" }] }

text

Static analysis

No suspicious patterns detected.