v0.1.4

ClawWallet

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:29 AM.

Analysis

ClawWallet is purpose-aligned for a wallet skill, but it installs and runs remote wallet-signing software, so users should review it carefully before trusting it with assets.

GuidanceReview the remote installer and binary provenance before installing, avoid using a high-value wallet until you trust the distribution chain, keep the local token and wallet state files private, and require explicit human confirmation for every transaction, policy change, reinstall, upgrade, or uninstall.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityHighConfidenceHighStatusConcern

install.sh

curl -fsSL "${CLAW_WALLET_BASE_URL}/skills/claw-wallet" -o claw-wallet ... BINARY_URL="${CLAW_WALLET_BASE_URL}/bin/${BINARY_NAME}" ... curl -L -o "$TMP_TARGET" "$BINARY_URL"

The installer downloads executable wrapper and sandbox binary components at install time from a remote host, with no checksum, signature, or pinned release verification shown in the artifacts.

User impactInstalling the skill requires trusting the remote distribution host to provide the code that will handle wallet sandbox operations.

RecommendationInstall only from a trusted source, prefer pinned releases with published hashes or signatures, and review the installer and binary provenance before using a valuable wallet.

Unexpected Code Execution

SeverityHighConfidenceHighStatusConcern

claw-wallet.sh

curl -fsSL "${CLAW_WALLET_BASE_URL}/install.sh" | bash

The upgrade path executes a remotely fetched shell script directly. For a wallet-signing skill, this is a high-impact execution path even though upgrades are documented as requiring user confirmation.

User impactA user or agent-triggered upgrade could replace and run wallet-related code from the remote host without an integrity check in the provided artifacts.

RecommendationDo not allow autonomous upgrades; download and inspect upgrade scripts first, and require verified hashes or signed releases for wallet software.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusNote

SKILL.md

Use this skill when the user wants to sign messages, sign transactions, or transfer assets ... Before executing any transaction, the agent **must** ask the user for confirmation

The skill explicitly supports high-impact wallet actions, while also documenting a confirmation requirement before transactions.

User impactIf a transaction is approved incorrectly, funds or wallet permissions could be affected.

RecommendationBefore confirming, verify the chain, recipient, amount, token, fees, contract, and any policy changes in plain language.

Rogue Agents

SeverityMediumConfidenceHighStatusNote

claw-wallet.sh

nohup setsid "$BIN" serve >> "$LOG_FILE" 2>&1 < /dev/null &

The wrapper starts the sandbox as a background process that can continue running after the immediate agent task completes.

User impactThe wallet sandbox may remain active until explicitly stopped, increasing the importance of token protection and process monitoring.

RecommendationStop the sandbox when not in use and monitor sandbox.log and sandbox.pid for expected activity.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusNote

skill.yml

primary_credential: CLAY_AGENT_TOKEN ... local_secret_fields: ... identity.json ... agent_token

The skill declares and uses local bearer-token and identity files that authorize access to the wallet sandbox.

User impactAnyone who obtains or misuses these local tokens or identity files may be able to interact with the wallet sandbox according to its permissions.

RecommendationKeep .env.clay, identity.json, and share3.json private, restrict file permissions, and rotate or reset tokens if they are exposed.