AI Walllet Payment System

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 PM UTC
• Version: 0.1.0

Overview

This wallet skill is not clearly malicious, but it handles real cryptocurrency transactions with serious implementation and documentation risks that could lead to fund loss.

Treat this as a Review item, not as proven malware. Do not install it for production, mainnet, or meaningful funds unless the transaction flow, key recovery design, dependency pins, HSM claims, and documentation are fixed and independently audited. If testing, use an isolated virtual environment, testnet-only funds, a trusted RPC provider, and assume generated wallets may become unrecoverable.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: ultra_secure_wallet_v13_MAXIMUM_SECURITY.py:1314

Finding

Time-Dependent Key Derivation Makes Private Keys Undecryptable

Content

View full analysis

bytes: """Derive purpose-specific key using HKDF""" # Check if rotation needed self._check_rotation() info = f"{purpose}:{time.time()}".encode('utf-8') if context: info += context hkdf = HKDF( algorithm=hashes.SHA512(), length=MaxSecurityConfig.KEY_SIZE, salt=self.salt, info=info, backend=default_backend() ) derived_key = hkdf.derive(self.master_key) return derived_key ``` The method is independently called when encrypting and decrypting wallet keys: ```python # During wallet creation encryption_key = self.key_manager.derive_key("wallet_encryption") ``` ```python # During private-key decryption encryption_key = self.key_manager.derive_key("wallet_encryption") ``` ### Technical Analysis HKDF deterministically returns the same key only when its input key material, salt, context, and `info` are identical. The implementation includes `time.time()` in the HKDF `info` field. Because the encryption and decryption calls occur at different times, they derive different keys. ChaCha20-Poly1305 authentication will consequently reject the stored ciphertext during decryption. This failure occurs even within the same application process and does not require a restart, key rotation, or an external attacker. ### Attack Path 1. A user initializes the wallet API. 2. `create_wallet()` derives an encryption key using the current timestamp. 3. The generated Ethereum private key is encrypted and the ciphertext is stored. 4. The user later calls `send_transaction()`. 5. `decrypt_private_key()` invokes `derive_key("wallet_enc ...[truncated 712 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: ultra_secure_wallet_v13_MAXIMUM_SECURITY.py:1298

Finding

Ephemeral Master-Key Parameters Prevent Database Recovery After Restart or Rotation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: ultra_secure_wallet_v13_MAXIMUM_SECURITY.py:1194

Finding

TPM Presence Is Incorrectly Treated as Functional HSM Protection

Content

View full analysis

bool: """Check if HSM is available""" # In production: Check for actual HSM # For now, we'll check if we're in a secure environment try: # Check for TPM tpm_present = Path('/dev/tpm0').exists() or Path('/dev/tpmrm0').exists() # Check for YubiHSM # yubihsm_present = self._check_yubihsm() # Check for AWS CloudHSM # cloudhsm_present = self._check_cloudhsm() return tpm_present # or yubihsm_present or cloudhsm_present except Exception: return False ``` When this test succeeds, the purported HSM operation still uses ordinary process memory: ```python def generate_key(self, key_type: str = 'AES256') -> bytes: """Generate key in HSM""" if self.available: # In production: Use HSM to generate key logging.info("Generating key in HSM") return secrets.token_bytes(32) else: # Fallback to secure software generation logging.warning("HSM not available, using software key generation") return secrets.token_bytes(32) def encrypt(self, plaintext: bytes, key_id: str) -> bytes: """Encrypt using HSM""" if self.available: # In production: Use HSM encryption logging.info(f"Encrypting with HSM key: {key_id}") # Fallback for demo return self._software_encrypt(plaintext) else: return self._software_encrypt(plaintext) ``` ### Technical Analysis A TPM device node is not evidence that an HSM-backed key has been provisioned, authorized, or used. The implementation treats the existence of `/dev/tpm0` or `/dev/tpmrm0` as successful HSM availability. Even when `available` is true, keys are g ...[truncated 1305 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: ultra_secure_wallet_v13_MAXIMUM_SECURITY.py:1858

Finding

Configured Transaction Security Limits Are Not Enforced

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: README.md:168

Finding

Documented Security Requirements and Transaction API Do Not Match the Implementation

Content

View full analysis

Dict: ``` The README also states: ```markdown ### Password Requirements - Minimum 20 characters - Must contain uppercase, lowercase, digits, and special characters - Minimum entropy: 80 bits ``` The implementation requires: ```python MIN_PASSWORD_LENGTH: Final[int] = 64 RECOMMENDED_PASSWORD_LENGTH: Final[int] = 128 MIN_PASSWORD_ENTROPY_BITS: Final[int] = 256 ``` ### Technical Analysis The documented transaction example raises a `TypeError` because `amount_eth` and `totp_code` are not accepted keyword parameters. The password policy documented to users also differs materially from the enforced policy. These discrepancies affect a security-sensitive API. Integrators following the documentation cannot perform transactions and may modify the implementation, weaken validation, or create unreviewed wrappers to make the examples work. The documentation also describes backup codes as one-time recovery codes, but the reviewed transaction authentication path only verifies TOTP codes; no backup-code verification or invalidation path was found. ### Attack Path No direct remote exploit is established. A realistic operational failure path is: 1. An integrator copies the documented transaction example. 2. The call fails because the keyword argu ...[truncated 877 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Known Vulnerable Dependency: pillow==10.0.0 — 16 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +13 more

Critical

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The requirements file pins Pillow 10.0.0, and the supplied advisories include severe issues such as possible arbitrary code execution and memory-safety problems. Since this skill also includes QR-code generation and image handling, Pillow is likely reachable in normal operation, increasing the chance that malicious image input could lead to denial of service, memory corruption, or code execution depending on the vulnerable code path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: web3==6.0.0 — 2 advisory(ies): CVE-2026-40072 (web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling); CVE-2026-40072 (web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The requirements file pins web3 to version 6.0.0, and the provided advisory indicates this version is affected by an SSRF issue in CCIP Read / OffchainLookup URL handling. In an AI wallet payment system, blockchain interactions are core functionality, so a vulnerable web3 client could let attacker-controlled on-chain responses trigger server-side requests to unintended internal or external endpoints.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==41.0.0 — 16 advisory(ies): CVE-2023-50782 (Python Cryptography package vulnerable to Bleichenbacher timing oracle attack); GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-26130 (cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates) +13 more

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The file pins cryptography to 41.0.0 despite multiple listed advisories affecting that version, including issues involving timing side channels and vulnerable bundled OpenSSL wheels. Because this project appears to handle wallet security, encryption, and authentication, weaknesses in a foundational cryptographic library can directly undermine confidentiality, integrity, or key-handling safety.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The module-level banner and guarantee text make sweeping security claims such as preventing every attack, wiping every secret, and implementing controls that are not actually present in the code. In a crypto wallet, these false assurances are dangerous because operators may trust the system with real funds and relax compensating controls based on inaccurate security claims.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The file advertises self-modifying, polymorphic, and metamorphic code in its security claims. Even though the behavior is not implemented here, such claims are a red flag in an agent skill because they normalize techniques associated with evasion, hinder review, and suggest deceptive documentation about how the code behaves.

Content

Scanner excerpt · ultra_secure_wallet_v13_MAXIMUM_SECURITY.py (reported line 62)May include surrounding context.

python

✓ Junk code insertion
✓ Opaque predicates
✓ Virtual machine obfuscation
✓ Self-modifying code
✓ Polymorphic code
✓ Metamorphic code
✓ White-box cryptography

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The transaction path signs and broadcasts an irreversible blockchain transfer immediately after API invocation without a separate explicit confirmation step showing recipient, amount, chain, and fees. In an agent-integrated payment skill, prompt injection, automation mistakes, or parameter confusion can therefore trigger unrecoverable fund loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide markets the system as 'secure' for AI-managed wallet and transaction use, but later discloses that it is experimental, unaudited, may contain vulnerabilities, and is suitable only for small amounts. This contradiction can cause operators to overtrust the skill with real funds, increasing the chance of financial loss from unsafe deployment.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt-get update
sudo apt-get install -y python3-dev libsqlcipher-dev build-essential libssl-dev

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt-get update
sudo apt-get install -y python3-dev libsqlcipher-dev build-essential libssl-dev

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt-get update
sudo apt-get install -y python3-dev libsqlcipher-dev build-essential libssl-dev

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt-get update
sudo apt-get install -y python3-dev libsqlcipher-dev build-essential libssl-dev

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

Ubuntu/Debian:

bash

sudo apt-get update
sudo apt-get install -y python3-dev libsqlcipher-dev build-essential libssl-dev

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The 'Implemented Security Features' list explicitly states 'Memory wiping' as a provided capability. Elsewhere, the guide warns that many claimed features are not implemented, which undermines confidence in categorical implementation claims and creates an intent/documentation mismatch unless the code clearly performs secure memory erasure. In this file, that claim is presented as implemented fact rather than aspirational or conditional behavior.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 2 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)

Medium

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The file pins python-dotenv to 1.0.0, which the provided advisory states is vulnerable to symlink-following behavior in set_key that can enable arbitrary file overwrite in certain usage patterns. This is less universally exploitable than the other findings because it depends on the application calling the affected functionality on attacker-influenced paths, but in deployment or tooling contexts it can still lead to configuration corruption or overwrite of sensitive files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The HSM interface claims HSM-backed key operations, but the implementation silently falls back to software-generated ephemeral keys and software encryption. This undermines the trust boundary around key custody and can cause users to believe hardware-backed protections exist when keys are actually handled in normal process memory.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The database component promises a write-once audit log, but the audit log is just a standard mutable SQLite table with no immutability or tamper-evidence enforcement. In a wallet system, mutable audit trails weaken incident response and allow post-incident deletion or alteration of evidence by anyone with DB write access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The wallet manager states that private keys are never cached, yet plaintext private keys are created in process memory during wallet creation and transaction signing. Even if briefly held, this contradicts the guarantee and increases exposure to memory disclosure, crash dumps, debugging, or malicious local inspection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The API claims HSM integration, perfect forward secrecy, anomaly detection, and hundreds of other protections that are not implemented in class behavior. This is especially dangerous in a payment wallet because downstream users may deploy it into production with unjustified confidence, exposing funds to avoidable compromise.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · ultra_secure_wallet_v13_MAXIMUM_SECURITY.py (reported line 1727)May include surrounding context.

python

# Check system security
        if hasattr(os, 'geteuid') and os.geteuid() == 0:
            raise SecurityException("NEVER run as root!")
        
        # Check for swap encryption (Linux)
        if platform.system() == 'Linux' and MaxSecurityConfig.DISABLE_SWAP:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Wallet creation returns the MFA secret and TOTP provisioning URI directly to the caller, and anyone who captures that response can enroll a second-factor generator and bypass MFA. In an agent or API setting, responses may be logged, forwarded, cached, or exposed to other tools, making this more dangerous than a local interactive setup flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.