WalletPilot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:18 AM UTC
• Version: 0.1.0

Overview

WalletPilot is a high-impact crypto wallet automation skill that is purpose-aligned but asks users to create and fund a wallet while its claimed safeguards and implementation are not included for review.

Review this carefully before installing. Do not fund a wallet or enter a seed phrase until you have the complete implementation, pinned dependencies, and verifiable enforcement for spend limits, allowlists, revocation, logging, and user confirmation for sends, swaps, approvals, and signatures. Use only minimal test funds or testnets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:73
• Finding: Wallet Funding and Automation Are Recommended Without Auditable Security Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-88`, `SKILL.md:167-174` **Vulnerability Type**: Unverifiable wallet security controls **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### 3. Create Agent Wallet Profile ```bash npm run setup ``` This opens a browser where you: - Install/setup your chosen wallet extension - Create a NEW wallet (fresh seed phrase) - The profile is saved for future automation ### 4. Fund the Wallet Transfer a small amount to your agent wallet: - Native token for gas (0.01-0.05 ETH/SOL recommended) - Tokens for operations (start small, e.g., $50 USDC) ``` The document later asserts that security controls are enforced: ```markdown ## Safety - **Isolated Profile:** Agent uses separate browser profile - **Separate Wallet:** Completely separate from your main wallet - **Spend Caps:** Hard limits prevent runaway spending - **Protocol Allowlist:** Only whitelisted contracts can be called - **Full Logging:** Every transaction is logged - **Revocation:** Set `"revoked": true` to disable all actions ``` ### Technical Analysis The submitted project contains only `SKILL.md`. It does not include the referenced `package.json`, setup script, wallet adapters, permission guard, configuration loader, transaction logger, tests, or other source files shown in the documented architecture. As a result, the following security properties cannot be verified: - Enforcement of per-transaction and daily spending limits. - Contract and chain allowlist validation. - User-approval thresholds. - Revocation behavior. - Isolation of the browser profile and wallet. - Safe handling of seed phrases and extension credentials. - Validation of recipients, transaction calldata, and message-signing requests. - Transaction logging and protection of those logs. The documentation invites users to create and fund a wallet while relying on controls that are absent from the submitted artifact. This is especially security-sensitive becau ...[truncated 1789 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the complete implementation referenced by the documentation: - `package.json` and a pinned lockfile. - Setup and execution scripts. - Browser-profile management. - Wallet adapters. - Permission enforcement and configuration parsing. - Transaction logging and price-estimation logic. - Automated security tests. 2. Enforce policies in a trusted transaction-validation layer immediately before signing, rather than only through browser-interface checks. 3. Default to denial when configuration is missing, malformed, stale, or cannot be evaluated. 4. Resolve and validate the chain ID, recipient, contract address, function selector, calldata, token amount, token decimals, and estimated fiat value before every signature. 5. Require explicit user confirmation for: - Arbitrary message and typed-data signing. - Token approvals and permit signatures. - Unknown contracts or recipients. - Transactions above a conservative threshold. - Blind-signing requests or undecodable calldata. 6. Store the wallet in an isolated browser profile with restrictive file permissions. Never log seed phrases, private keys, passwords, or complete sensitive signing payloads. 7. Implement tamper-resistant accounting for daily and per-transaction limits and test concurrency, restart, decimal-conversion, price-oracle, and multi-chain bypass cases. 8. Add integration tests proving that revocation, allowlists, blocked methods, approval thresholds, and spending caps fail closed. 9. Clearly state that users must not fund the wallet until the exact implementation and its dependencies have been independently reviewed. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:53
• Finding: Unpinned and Unreviewable npm Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:53-59` **Vulnerability Type**: Unsafe dependency installation instructions **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown ### 1. Install Dependencies ```bash cd wallet-pilot npm install npx playwright install chromium ``` ``` ### Technical Analysis The instructions direct users to run `npm install` and `npx playwright install chromium`, but the audited project contains no `package.json`, lockfile, integrity metadata, or dependency inventory. Without these files, auditors and users cannot determine: - Which packages and versions are expected. - Whether npm lifecycle scripts will execute. - Whether dependency names are legitimate. - Whether transitive dependencies are pinned. - Which Playwright version supplies the `npx` command. - Whether the downloaded browser binary is the expected artifact. `npm install` can execute dependency lifecycle scripts with the invoking user's privileges. Depending on the local npm environment, `npx` can also resolve and obtain a package when a suitable local executable is unavailable. This creates an unreviewable supply-chain boundary in a workflow that later handles a funded cryptocurrency wallet and persistent browser profile. As submitted, the command is not operational because the required manifest is absent. Exploitation therefore depends on the user obtaining an additional package context or following updated instructions from an external source. ### Attack Path 1. A user follows the installation section and enters a directory containing an externally obtained or subsequently supplied npm manifest. 2. The manifest references a malicious, compromised, typosquatted, dependency-confusion, or unexpectedly updated package. 3. `npm install` downloads the package and executes an associated lifecycle script. 4. Alternatively, `npx` resolves tooling that was not pinned or reviewed with this artifact. 5. The executed dependency gains the same opera ...[truncated 998 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Add a complete `package.json` and commit a lockfile generated by a supported npm version. 2. Replace general installation guidance with a deterministic command such as: ```bash npm ci --ignore-scripts ``` Only enable lifecycle scripts after individually reviewing and documenting why each one is required. 3. Pin Playwright to an exact reviewed version in the project manifest and invoke the local binary rather than allowing `npx` to resolve an unspecified package. 4. Document the expected npm registry and use registry-scoped configuration where appropriate to reduce dependency-confusion risk. 5. Review direct and transitive dependencies for: - Typosquatting. - Unexpected maintainers or ownership changes. - Install scripts. - Known vulnerabilities. - Unnecessary network, filesystem, or process permissions. 6. Use lockfile integrity checks, dependency allowlists, automated vulnerability scanning, and reproducible build verification. 7. Run installation and browser setup in an isolated, non-privileged environment that contains no wallet secrets or funded browser profiles. 8. Separate dependency installation from wallet creation. Do not enter seed phrases or fund a wallet until the complete dependency tree and produced artifacts have been verified. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The overview describes agent interaction with dapps and transaction execution through browser wallets, but it does not clearly and prominently warn that this automation can trigger real on-chain transactions affecting actual funds. The later mention of a separate wallet helps, but it does not fully communicate the severity of irreversible loss, approval risk, or the possibility of signing harmful payloads. In this context, under-warning is dangerous because the skill is explicitly designed to automate live wallet activity.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The setup instructions invoke `npx playwright install chromium` without pinning a specific package version. `npx` may resolve and execute whatever version is currently published or otherwise selected in the environment, creating a supply-chain risk during installation. In a skill intended for wallet automation, any compromise in the browser automation toolchain is especially sensitive because it could affect software that later handles real wallet interactions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes high-risk actions such as `swap`, `send`, and `sign` but does not place explicit warnings next to those commands about irreversible fund loss, malicious approvals, and phishing or signature abuse. Users may treat these as routine automation primitives and underestimate that message signing and contract interaction can authorize asset theft or unsafe approvals. Because this skill targets browser wallets, these actions directly map to financially sensitive operations.

Static analysis

No suspicious patterns detected.