ClawHub
Back to skill

Security audit

WalletPilot 7715

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent but asks agents to automate real blockchain transactions, and its examples leave too much room for irreversible loss if used as written.

Review carefully before installing or using this skill. Use a test wallet first, pin and audit the SDK version, keep API keys narrowly scoped, grant short-lived permissions with low spend limits and contract allowlists, and require transaction simulation plus explicit approval before swaps or transfers.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:28
Finding

Unpinned Third-Party SDK Has Access to Financial Credentials and Transaction Authority

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-31
Vulnerability Type: Unpinned security-sensitive dependency
Risk Level: High

Evidence

markdown
## Setup

1. Get an API key at [walletpilot.xyz](https://walletpilot.xyz)
2. Install the SDK: `npm install @walletpilot/sdk`

Technical Analysis

The installation command does not specify an exact package version, lockfile, or integrity hash. Consequently, it installs whichever release is resolved from the npm registry at installation time. This makes the reviewed behavior non-reproducible and exposes users to future compromised, malicious, or unexpectedly changed package releases.

The dependency is especially security-sensitive because the documented examples initialize it with a WalletPilot API key and use it to request wallet permissions and execute blockchain transactions. A compromised package could access the credential, replace transaction destinations or calldata, submit unauthorized transactions within active permission limits, or misrepresent permission requests.

No evidence in the reviewed file proves that the current package is malicious. The vulnerability is the unsafe dependency acquisition method and the resulting supply-chain exposure.

Attack Path

  1. An attacker compromises the npm publisher account, package build pipeline, or another part of the package distribution chain.
  2. The attacker publishes a malicious version of @walletpilot/sdk.
  3. A user follows the documented unpinned installation command.
  4. npm resolves and installs the attacker-controlled release.
  5. The agent initializes the SDK with a WalletPilot API key and invokes wallet operations.
  6. The malicious SDK captures credentials or modifies permission and transaction requests.
  7. The attacker abuses the obtained authority to disclose wallet activity or execute transactions within the permissions granted by the user.

Impact Assessment

Suc ...[truncated 567 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin @walletpilot/sdk to a reviewed exact version rather than a floating release.
  • Provide and enforce a committed package lockfile.
  • Verify package provenance, registry ownership, signatures, and integrity hashes before installation.
  • Use npm ci in automated environments to ensure reproducible dependency resolution.
  • Audit the SDK source and its transitive dependency tree before granting it access to credentials or transaction capabilities.
  • Run the SDK with narrowly scoped and revocable API credentials.
  • Restrict wallet permissions by contract, chain, token, amount, and expiration so dependency compromise cannot obtain broad transaction authority.
  • Establish an update-review process instead of automatically consuming new releases.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:81
Finding

Unvalidated Remote Transaction Payload Is Forwarded for On-Chain Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 81-92
Vulnerability Type: Execution of untrusted remote transaction data
Risk Level: High

Evidence

typescript
// Get swap quote from 1inch, 0x, or similar
const quote = await fetch('https://api.1inch.io/v5.0/1/swap?...');
const { tx } = await quote.json();

// Execute via WalletPilot
await pilot.execute({
  to: tx.to,
  data: tx.data,
  value: tx.value,
  chainId: 1,
});

Technical Analysis

The example retrieves transaction fields from an external service and forwards the returned destination, calldata, and native-token value directly to pilot.execute. It does not validate the response schema, destination contract, function selector, token addresses, recipient, input amount, output amount, slippage, allowance target, or native-token value.

HTTPS protects data in transit under ordinary conditions, but it does not establish that the service response reflects the user's intended trade. A compromised service, API credential, upstream integration, client environment, or service implementation could return a transaction that invokes an unintended contract operation. The fixed chainId: 1 also does not substitute for semantic validation of the returned transaction.

ERC-7715 spend and chain restrictions may limit maximum loss, but they do not prove that a particular contract call is safe or intended. Any malicious operation that remains within the granted permission envelope may still be accepted.

Attack Path

  1. The agent requests a swap quote from the external DEX aggregation endpoint.
  2. An attacker compromises or influences the quote service, an upstream component, or the client-side request environment.
  3. The attacker returns altered tx.to, tx.data, or tx.value fields.
  4. The Skill forwards those fields to pilot.execute without decoding or validating them.
  5. WalletPilot executes the supplied transaction if i ...[truncated 836 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat every quote response as untrusted input and validate its complete schema.
  • Require the returned transaction chain to match the requested and permitted chain.
  • Maintain explicit allowlists for DEX router, token, spender, and recipient addresses.
  • Decode calldata before execution and permit only expected function selectors and argument structures.
  • Verify input token, output token, recipient, amount, minimum output, deadline, allowance target, and native-token value against the user's request.
  • Enforce independent slippage, price-impact, amount, and fee limits rather than relying exclusively on values returned by the quote service.
  • Simulate the transaction and inspect asset balance changes, approvals, internal calls, and reverts before submission.
  • Require explicit user confirmation when decoded behavior differs from the requested operation or exceeds a low-risk threshold.
  • Use short-lived, per-operation permissions with contract allowlists instead of broad multi-day authority wherever practical.
  • Fail closed when fields are missing, malformed, inconsistent, or cannot be decoded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill provides ready-to-use examples for swaps and token transfers in a wallet-automation context without prominently warning that blockchain transactions are irreversible, may incur slippage/MEV/approval risk, and can permanently lose user funds if parameters are wrong or the quote source is malicious. In an agent skill designed to automate on-chain execution, omission of these warnings materially increases the chance that developers expose users to unsafe autonomous asset movement.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

typescript
// Get swap quote from 1inch, 0x, or similar
const quote = await fetch('https://api.1inch.io/v5.0/1/swap?...');
const { tx } = await quote.json();

// Execute via WalletPilot

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
console.log('Active permissions:', state.permissions);

// Or via API
const response = await fetch('https://api.walletpilot.xyz/v1/tx/history/PERMISSION_ID', {
  headers: { 'Authorization': 'Bearer wp_...' },
});
const { data } = await response.json();

Static analysis

No suspicious patterns detected.