Skillv0.1.0

ClawScan security

WalletPilot 7715 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 11, 2026, 8:54 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's purpose (agent-driven on-chain transactions) matches the instructions, but the published metadata omits required credentials and source/installation details and the instructions would allow autonomous execution within user-granted spend limits — these mismatches and external dependencies warrant caution.
Guidance: Do not install or give this skill access to secrets until you verify the vendor and the SDK. Steps to reduce risk: - Confirm the project identity: visit walletpilot.xyz, inspect the GitHub repo (https://github.com/andreolf/walletpilot) and verify the npm package @walletpilot/sdk source code and recent commits. Ensure the repo and website match and appear legitimate. - Require the maintainer to declare the required secret(s) in the registry (primaryEnv) so you can manage them via your agent's secrets store rather than placing keys in plain environment variables. - Audit the SDK code (or a trusted third party) to confirm it does not accept private keys or expose other sensitive flows, and check what the apiKey authorizes server-side. - Limit permissions before granting them: use minimal spend limits, restrict chains and contract allowlists, and set short expiry periods. Test on a testnet or with a tiny amount first. - Ensure the agent prompts you for every non-trivial transaction (explicit human confirmation) rather than auto-executing trades simply because state.connected is true. - If you must proceed, store the API key in a secrets manager, do not place it in general environment variables, and monitor all WalletPilot-related activity (permission list, tx history, and revocations). If you cannot confirm the provider and audit the SDK, treat this skill as high-risk for financial loss and avoid giving it credentials or wide permissions.

Review Dimensions

Purpose & Capability: concernThe SKILL.md describes a wallet/transaction agent built on a WalletPilot API and MetaMask ERC-7715 permissions, which legitimately requires an API key and interaction with a user wallet. However, the registry metadata lists no required environment variables or primary credential even though examples repeatedly use an apiKey (e.g., 'wp_...' and process.env.WALLETPILOT_KEY). The skill also advertises external endpoints and a published SDK; those are coherent with the stated purpose but the metadata omission is inconsistent.
Instruction Scope: concernThe instructions direct the agent to request permissions (deep links to MetaMask), fetch swap quotes from third-party aggregators (1inch/0x), and call WalletPilot endpoints to execute transactions. They rely on pilot.getState to decide whether to execute trades; if an API key and active permission exist the agent is instructed to execute without an explicit per-transaction confirmation step in the examples. The SKILL.md does not instruct the agent to prompt the human for each transaction, which could enable autonomous spending within granted limits.
Install Mechanism: noteThere is no formal install spec in the registry (instruction-only), which reduces automatic disk footprint risk. The README tells users to run `npm install @walletpilot/sdk` and obtain an API key from walletpilot.xyz — installing an npm package is normal for this use-case but the skill provides no integrity/source verification in metadata. Because the skill performs financial actions, verifying the SDK source (npm GitHub repo, checksums) is important.
Credentials: concernExamples use an API key (e.g., new WalletPilot({ apiKey: 'wp_...' }) and process.env.WALLETPILOT_KEY) and the history example shows Bearer wp_... header usage, but the skill metadata declares no required env vars or primary credential. That mismatch is problematic: the runtime requires a secret (API key) but the registry doesn't surface it. No private key is requested, which is appropriate, but the missing declaration of the API credential and any guidance on its scope/rotation is a concern.
Persistence & Privilege: noteThe skill is not marked always:true (good). Model invocation is allowed by default; combined with the ability to execute transactions this increases blast radius if an agent has the API key and active permissions. The SKILL.md relies on user-granted on-chain permissions (ERC-7715) for spend control, but examples show automatic execution once state.connected is true — the lack of enforced per-transaction human confirmation in examples increases risk and should be considered by the user.