ClawHub
Back to skill

Security audit

Digital Health

Security checks for vulnerabilities and agentic risk

Overview

This payment skill is coherent and not deceptive, but it gives high-impact crypto payment guidance with weak validation and autonomous wallet instructions that need careful review before use.

Review and harden this before installing in any wallet-enabled environment. Use testnet by default, pin and inspect the Privy skill before installation, keep Privy secrets server-side, require exact local allowlists for contracts, recipients, tokens, networks, executors, and amounts, remove fallback option selection, and require human approval or strong policy limits for any autonomous payment path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:169
Finding

Unpinned External Skill Installation Creates a Mutable Supply-Chain Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 169-172
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

Vulnerable Code

markdown
- **Install in project**:  
  `git clone https://github.com/privy-io/privy-agentic-wallets-skill.git .cursor/skills/privy`  
  (or into `~/.openclaw/workspace/skills/privy` for OpenClaw). Add `PRIVY_APP_ID` and `PRIVY_APP_SECRET` from [dashboard.privy.io](https://dashboard.privy.io).

Technical Analysis

The documented installation procedure clones the current default branch of a third-party Git repository directly into an active Skill directory. It does not pin a reviewed commit or release and does not require signature, checksum, or content verification.

Consequently, the effective Skill content installed by this command can differ from the content that was originally reviewed. Because the destination is a directory from which Cursor or OpenClaw may load agent instructions, changes or compromise of the upstream repository could introduce attacker-controlled instructions into a wallet-enabled environment.

The risk is increased by the adjacent instruction to configure PRIVY_APP_ID and PRIVY_APP_SECRET. A malicious dependency loaded in that environment could attempt to influence the agent into disclosing credentials, invoking wallet APIs, or performing unauthorized signing operations.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or its default branch.
  2. The attacker adds malicious or misleading instructions to the external Skill.
  3. A user follows the documented git clone command without specifying a reviewed commit.
  4. The mutable repository content is placed in .cursor/skills/privy or the OpenClaw Skill directory.
  5. The agent loads and trusts the newly installed Skill.
  6. In a Privy-enabled environment, the malicious instructions attempt to misuse configured credentials ...[truncated 641 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed immutable commit:
    sh
    git clone https://github.com/privy-io/privy-agentic-wallets-skill.git /tmp/privy-skill-review
cd /tmp/privy-skill-review
git checkout --detach <reviewed-commit-sha>
  2. Verify the commit against a trusted release, signed tag, or independently distributed checksum.
  3. Review every Skill instruction, script, manifest, and referenced executable before moving the content into an active Skill directory.
  4. Record the approved repository URL, commit hash, review date, and expected file hashes in project documentation.
  5. Do not automatically update the dependency. Require security review before changing the pinned revision.
  6. Keep PRIVY_APP_SECRET in a server-side secret manager and prevent Skill content, browser code, logs, and prompts from reading it.
  7. Apply restrictive Privy wallet policies, including contract allowlists, recipient restrictions, per-transaction limits, cumulative spending limits, and network restrictions.
  8. Prefer installing into a staging directory first rather than cloning external content directly into an active agent Skill directory.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:28
Finding

Remote Payment Parameters Are Not Strictly Bound to Trusted Local Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28-98
Vulnerability Type: Insufficient validation of wallet authorization and payment parameters
Risk Level: High

Vulnerable Code

USDC payment-option selection and authorization construction are documented at lines 28-47:

markdown
3. **Pick USDC option**  
   - From `accepts`, choose entry where `asset` matches USDC on Base Sepolia or `extra.name === "USDC"`.  
   - Use `amount`, `asset`, `payTo`, `extra.name` / `extra.version` for EIP-712.

4. **Build EIP-3009 authorization**  
   - Domain: `name` = `extra?.name ?? "USDC"`, `version` = `extra?.version ?? "2"`, `chainId` = 84532, `verifyingContract` = `asset`.  
   - Type: `TransferWithAuthorization`: `from`, `to`, `value`, `validAfter` (0), `validBefore` (e.g. now + 300s), `nonce` (32 random bytes as hex).  
   - Sign with `signTypedData` (EIP-712).

5. **Send payment and retry**  
   - Build payload: `{ x402Version: 2, scheme, network, accepted: { scheme, network, amount, asset, payTo, maxTimeoutSeconds, extra? }, payload: { signature, authorization: message }, extensions: {} }`.  
   - `PAYMENT-SIGNATURE` = base64(JSON.stringify(payload)).  
   - Same URL: `GET` with header `PAYMENT-SIGNATURE: <base64>`.

DHM option selection and signing are documented at lines 89-98:

markdown
3. **Pick option**  
   `options.find(o => o.type === "evvm_pay" || o.id === "dhm-evvm") ?? options[0]`. Ensure `to` and `suggestedNonce` are present.

4. **Build EVVM pay message**  
   - Hash payload for Core: `keccak256(encodeAbiParameters("string, address, string, address, uint256, uint256", ["pay", to, toIdentity, token, amount, priorityFee]))`.  
   - Message string: `evvmId, coreAddress, hashPayload, executor, nonce, isAsyncExec` (comma-separated).  
   - Use `buildEvvmPayMessageCoreDoc` from `frontend/src/lib/evvmSign.ts` with: evvmId, coreAddress, to, "", token, amount, priorityFee, e
...[truncated 3460 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require exact equality with locally trusted values before signing:
    • chain ID: 84532;
    • USDC contract: 0x036CbD53842c5426634e7929541eC2318f3dCF7e;
    • expected x402 scheme and network identifiers;
    • approved EVVM ID and Core address;
    • approved DHM token address;
    • approved recipient or a narrowly controlled recipient allowlist.
  2. Never accept a token based only on extra.name, symbol, display name, or other server-controlled metadata.
  3. Remove the ?? options[0] fallback. Reject the challenge unless exactly one option satisfies every local validation requirement.
  4. Parse amounts and fees using integer-safe types, reject malformed or negative values, and enforce explicit maximums before signing.
  5. Bind the recipient, token, contract, network, amount, priority fee, executor, nonce, and asynchronous-execution flag to a local payment policy.
  6. Validate that the challenge URL uses HTTPS and matches an explicit host allowlist. Do not follow cross-origin redirects when retrying with a payment-signature header.
  7. Enforce short authorization expiry periods and maintain nonce replay protection.
  8. Present the verified recipient, token contract, amount, chain, and contract address to human users before browser-wallet signing.
  9. For autonomous Privy wallets, configure server-enforced contract, method, token, recipient, amount, rate, and cumulative-spending restrictions. Application-side checks should supplement rather than replace wallet policy.
  10. Abort safely when the 402 response contains unknown fields, inconsistent top-level and option-level values, multiple ambiguous matches, or a mismatch with local configuration.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly encourages autonomous payment flows using agent-controlled wallets and "no user click" execution, but it does not include a prominent warning that these actions can spend real funds or trigger irreversible blockchain transactions without human confirmation. In a payments skill, that omission materially increases the risk that downstream agents or developers will implement unattended spending paths without adequate consent, environment gating, or spend limits.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The text instructs users to create persistent server wallets that AI agents control and to sign/send transactions via API without user interaction. Persistent agent-controlled signing infrastructure is security-sensitive because compromise of the agent runtime, API credentials, or policy configuration could enable unauthorized transactions at machine speed, especially when the skill frames this as a straightforward extension path.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
### Leverage the Privy skill

- **Skill**: [privy-io/privy-agentic-wallets-skill](https://github.com/privy-io/privy-agentic-wallets-skill) — create server wallets that AI agents control with policy guardrails; sign and send transactions via the Privy API (no user click).
- **Install in project**:  
  `git clone https://github.com/privy-io/privy-agentic-wallets-skill.git .cursor/skills/privy`  
  (or into `~/.openclaw/workspace/skills/privy` for OpenClaw). Add `PRIVY_APP_ID` and `PRIVY_APP_SECRET` from [dashboard.privy.io](https://dashboard.privy.io).