Security audit

Check Wallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet-checking skill is read-only and purpose-aligned, but it runs an unpinned remote CLI in an authenticated wallet context and displays sensitive wallet data automatically.

Review this before installing if you use OpenAnt wallets on the same machine. Prefer a version that pins @openant-ai/cli to a reviewed release, asks before showing full addresses or balances, and runs with minimal filesystem, environment, and network access. There is no artifact evidence of theft, transfers, destructive behavior, or persistence, but the current dynamic CLI execution model is too broad for sensitive wallet data.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Execution of an Unpinned npm Package Through a Mutable Latest Tag
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The manifest's allowed-tools whitelist includes Bash(npx @openant-ai/cli@latest wallet *) and Bash(npx @openant-ai/cli@latest status*), explicitly authorizing dynamic execution of the latest published package. Because this is the enforcement layer for what the agent may run, the unpinned reference materially expands the attack surface and could enable compromise of wallet data or auth state across all permitted commands.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description uses broad trigger phrases such as 'check my wallet', 'what's my address', and 'check funds', making accidental invocation more likely in ordinary conversation. Because invocation exposes financial metadata and may run authenticated tooling automatically, unintended activation can disclose sensitive wallet addresses and balances without sufficiently deliberate user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill executes npx @openant-ai/cli@latest, which fetches and runs whatever code is currently published under that package name rather than a reviewed, immutable version. In a wallet-related skill, this creates a software supply-chain risk: a compromised upstream package or malicious update could access local credentials, wallet metadata, or manipulate outputs at runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This command again relies on @latest, so the agent would execute unpinned remote code each time the status check runs. Because the skill explicitly depends on locally stored authentication, any malicious package update could inspect or exfiltrate auth state or influence subsequent wallet operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is designed to reveal wallet addresses and balances, but it does not present a clear user-facing privacy warning about exposing sensitive financial metadata. Even if the actions are read-only, addresses and balances can be highly sensitive and may enable tracking, profiling, or accidental sharing in chats or logs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Listing wallet addresses via an unpinned npx package exposes a supply-chain execution path in a sensitive context. Even though the documented action is read-only, the invoked package code runs with local user permissions and can access wallet-related state before returning address data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Balance queries are presented as routine and safe, but the implementation still executes unreviewed remote code because of @latest. In a financial skill, that is dangerous because a malicious update could harvest wallet balances, addresses, or local credentials and mislead the model about available funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Custom-RPC examples still use the unpinned package, so users or agents following documented fallback flows would continue to execute mutable remote code. The ability to specify alternate RPC endpoints does not mitigate the core risk that the executable itself is not fixed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The example balance check repeats execution of @latest, normalizing a supply-chain unsafe practice throughout the skill. Frequent read-only invocations in authenticated contexts increase exposure because the package may run many times and observe sensitive wallet state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This address-query example also executes mutable remote code through @latest. Because the command reveals receiving addresses, a compromised package could silently exfiltrate them or substitute attacker-controlled addresses in output presented to the user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example again instructs use of @latest in a wallet-balance context. Even when only token holdings are queried, the package has an opportunity to access local environment data and misreport balances, which could affect later financial decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The repeated command on this line carries the same unpinned-package risk and reinforces insecure operator behavior. In a skill designed for agents, repetition matters because the model may copy any of these examples into live execution paths.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Although this line is a comment/instruction rather than an executable command, it is part of a sequence teaching use of the unpinned balance command and contributes to unsafe invocation patterns. In agentic settings, instructional context can directly shape tool execution behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This multi-line balance example still anchors on @latest, preserving the same supply-chain exposure in a mainnet-check scenario. The financial context makes the risk more severe because users may trust the result to make payment or trading decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The prerequisites section uses @latest for the auth-status check, which again means mutable code runs before sensitive wallet queries. Any compromise here could enumerate whether credentials are present and pivot to collecting or abusing them.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The error-handling guidance references login with @latest, extending the same supply-chain risk into authentication flows. Login paths are especially sensitive because malicious code could capture credentials or tokens at the moment they are entered or refreshed.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.