Security audit

AC2 Reference

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed wallet-signing and paid-fetch plugin that requires user wallet approval for sensitive actions, though users should understand the payment, git-signing, and session-persistence behavior before installing.

Install this only if you want OpenClaw to interact with an AC2 wallet. Review every wallet approval prompt, set x402 spend and recipient allow-lists where possible, avoid the optional curl-to-bash installer unless you trust and inspect it, and remember that AC2 git signing rewrites commit hashes while AC2 connection metadata and chat history may persist across reconnects.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 70% confidence
Finding: Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
Content: Scanner excerpt · skills/ac2/CLAUDE.md (reported line 51)May include surrounding context.
md
are integer Unix **seconds**. - MUST NOT bypass the `ac2-v1` DataChannel for any AC2 message. - MUST NOT report a placeholder identity (e.g. `did:key:zAc2Controller`); always answer from `ac2_capabilities`. - MUST NOT guess or infer an Algorand sender in the model; use `ac2_capabilities.session.walletAddress`.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document declares extension capability identifiers (ac2-ext-x402/fetch, ac2-ext-git/sign) but later states the agent does not implement any AC2 extension. In a wallet-signing skill, contradictory security-relevant documentation can mislead operators, downstream agents, or integrators into invoking unsupported signing/fetch paths or trusting capabilities that are not actually present, increasing the chance of unsafe workflow assumptions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · skills/ac2/SKILL.md (reported line 197)May include surrounding context.
md
These markdowns ship alongside this `SKILL.md` in the same directory. OpenClaw only auto-loads `SKILL.md`; the others are on-disk reference material aligned to

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · skills/ac2/SKILL.md (reported line 212)May include surrounding context.
md
These markdowns ship alongside this `SKILL.md` in the same directory. OpenClaw only auto-loads `SKILL.md`; the others are on-disk reference material aligned to

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/ac2/IDENTITY.md (reported line 29)May include surrounding context.
md
The agent presents itself via these fields, populated at runtime by `ac2_capabilities`: | Field | Source | Meaning | | --------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | `did` | `ac2_capabilities.agent.did` | The agent's own `did:key`, issued by the Controller's wallet during pairing. The agent signs its envelopes as this DID. | | `name` | `ac2_capabilities.agent.plugin.id` | Human-readable plugin identifier (`ac2`). |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/ac2/IDENTITY.md (reported line 33)May include surrounding context.
md
| --------------- | ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- | | `did` | `ac2_capabilities.agent.did` | The agent's own `did:key`, issued by the Controller's wallet during pairing. The agent signs its envelopes as this DID. | | `name` | `ac2_capabilities.agent.plugin.id` | Human-readable plugin identifier (`ac2`). | | `version` | `ac2_capabilities.agent.plugin.version` | Plugin semver. | | `controllerDid` | `ac2_capabilities.session.controllerDid` | The Controller account currently paired (NOT part of the agent's identity — it identifies the _peer_). | | `walletAddress` | `ac2_capabilities.session.walletAddress` | The Controller's validated public Algorand account address, suitable for manually constructing transactions. |

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The frontmatter description says this skill is a compliance declaration that names DIDs, key types, and capability identifiers presented on the AC2 channel. However, the document goes beyond identity declaration by claiming concrete extension capabilities for paid HTTP fetch and git signing, which are operational behaviors not justified by an identity-only declaration and are broader than the file’s stated purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to invoke wallet-signing behavior whenever the user says broad terms like 'sign', 'approve', or 'authorize', even if they do not mention AC2. In a wallet-signing context, this can cause unintended activation on ambiguous requests and increase the chance that the agent initiates sensitive signing or payment flows without sufficiently specific user intent.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · skills/ac2/USER.md (reported line 41)May include surrounding context.
md
For each `ac2_sign` invocation the Controller (via the agent's prompt or the wallet UI) MAY adjust: | Field | Source | Effect | | -------------------- | ---------------------------------------- | ---------------------------------------------------------------------------------------------- | | `description` | Agent (validated by user in modal) | The only string the user reads before approving. MUST be honest. | | `sig_hint` | Agent (from `ac2_capabilities` catalog) | Selects the curve / envelope. MUST be explicit; omission falls back to Ed25519 over raw bytes. |

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The markdown states that ac2 git-sign "signs existing commits in place after git commit", which implies an irreversible repository-history modification. The file does not include a user-facing warning about the potential impact of rewriting commit metadata or advise caution before using this capability.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.