Security audit

Agent-Wallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill does what it says, but it handles wallet secrets and real transfers with enough under-hardened safeguards that users should review it before installing.

Install only if you are comfortable with a local script-based wallet that can sign and send real funds. Avoid entering seed phrases or private keys as command-line arguments, use a high-entropy WALLET_SECRET_KEY, restrict access to the wallet directory, and review configured chains carefully before broadcasting transactions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/import-wallet.js:14
Finding: Wallet Secrets Exposed Through Command-Line Arguments
Content: View full analysis
" ``` or: ```text node scripts/import-wallet.js --privateKey=0x... ``` ### Technical Analysis The import workflow reads seed phrases and private keys directly from `process.argv`. Command-line arguments are not an appropriate transport for high-value secrets because they can be exposed through: - Shell history files. - Process inspection utilities and operating-system process metadata. - Terminal session recording. - CI/CD and automation logs. - Agent tool-call histories or execution traces. - Diagnostic and monitoring systems that record process arguments. Encrypting the secret before writing `wallet/signer.json` does not address this exposure because the plaintext secret has already crossed several observable interfaces before encryption occurs. This also conflicts with the Skill's stated rule that full seed phrases and private keys must not be exposed in logs. ### Attack Path 1. A user follows the documented import command and supplies a seed phrase or private key as a CLI argument. 2. The shell records the command in its history, or the operating system exposes the process arguments while the process is running. 3. Another local user, monitoring service, terminal logger, CI system, or compromised process reads the argument. 4. The attacker obtains the complete seed phrase or private key. 5. The ...[truncated 633 chars]
Remediation: View remediation
| ...`, since that can still disclose the secret through shell history and process arguments. - Ensure errors, debug output, telemetry, and execution traces never include the supplied secret. - Clear temporary in-memory buffers where practical after account derivation and encryption. - Update every example in `SKILL.md` so that no wallet secret appears in a command-line argument. - Add automated tests that reject secret-bearing CLI options and verify that failure output does not contain supplied secret values. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/secret-crypto.js:42
Finding: Weak Password-Based Key Derivation and Permissive Wallet File Creation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send.js:227
Finding: Mainnet Double Confirmation Can Be Bypassed on Unlisted Production Chains
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
- `send` (native): `node scripts/send.js --to=0x... --amount=<native-amount> --confirm=true [--confirmMainnet=true]`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- `send` (native): `node scripts/send.js --to=0x... --amount=<native-amount> --confirm=true [--confirmMainnet=true]`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
md
- `send` (native): `node scripts/send.js --to=0x... --amount=<native-amount> --confirm=true [--confirmMainnet=true]`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
- `send` (native): `node scripts/send.js --to=0x... --amount=<native-amount> --confirm=true [--confirmMainnet=true]`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
- `send` (native): `node scripts/send.js --to=0x... --amount=<native-amount> --confirm=true [--confirmMainnet=true]`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill explicitly declares access to environment secrets via WALLET_SECRET_KEY and instructs execution of local Node scripts, but it does not define any explicit tool scope such as permissions or allowed-tools. In an agent setting, this creates ambiguous authority boundaries and can allow broader-than-necessary access to env-backed secrets or execution surfaces, increasing the risk of secret misuse or unintended command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script accepts a seed phrase or private key and persists it to wallet/signer.json after encryption, but provides no explicit warning, confirmation, or safeguards around storing long-term wallet credentials on local disk. In an agent skill context, this is risky because users may unknowingly cause highly sensitive wallet material to be written to a filesystem that could be accessible to other processes, backups, logs, or operators, increasing the chance of credential compromise if the encryption layer or host environment is weak.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/generate-wallet.js:75

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/import-wallet.js:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:35