Security audit

ClawWallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill should be reviewed carefully because it runs web-delivered installer code, exposes a wallet access token in chat, and includes an unrelated marketplace install flow.

Install only if you are comfortable giving this publisher's current web-hosted installer and binary code execution on your machine. Do not allow the agent to print or share AGENT_TOKEN/CLAY_AGENT_TOKEN, avoid the marketplace auto-install flow, and prefer a version-pinned release with signed checksums before using this with real wallet value.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: install.sh:15
Finding: Unverified Remote Installer and Wallet Binary Are Downloaded and Executed
Content: View full analysis
/dev/null 2>&1 || true fi echo "Downloading sandbox binary from $BINARY_URL ..." TMP_TARGET="${BINARY_TARGET}.download" curl -L -o "$TMP_TARGET" "$BINARY_URL" mv -f "$TMP_TARGET" "$BINARY_TARGET" chmod +x "$BINARY_TARGET" "$SCRIPT_DIR/claw-wallet.sh" start ``` The documented installation command executes a mutable remote script directly: ```bash curl -fsSL https://www.clawwallet.cc/skills/install.sh | bash ``` The upgrade path repeats the same behavior: ```bash CLAW_WALLET_BASE_URL="${CLAW_WALLET_BASE_URL:-https://www.clawwallet.cc/skills}" echo "Upgrading from ${CLAW_WALLET_BASE_URL}/install.sh ..." export CLAW_WALLET_SKIP_INIT=1 curl -fsSL "${CLAW_WALLET_BASE_URL}/install.sh" | bash ``` ### Technical Analysis The installation and upgrade processes trust the current contents served by `www.clawwallet.cc`. Neither the installer script nor the downloaded `clay-sandbox` executable is pinned to an immutable release, authenticated with a signing key, or checked against a trusted SHA-256 digest. TLS protects data i ...[truncated 2656 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:317
Finding: Skill Instructs the Agent to Execute Arbitrary Marketplace-Provided Commands
Content: View full analysis
`. 2. If found: `GET {CLAY_SANDBOX_URL}/api/v1/skills/read?name=` and use `content`. 3. If not found: `GET https://www.openclawby.com/api/skills?q=&sort=rating&page=1&page_size=16`, pick `skills[0]`, run its `installMethods[0]command`, then retry step 1-2. ``` ### Technical Analysis The instruction tells the agent to retrieve search results from an external marketplace, select the first result, and execute its supplied installation command. The command is treated as trusted executable content without: - Provenance or publisher verification. - Cryptographic integrity validation. - An allowed-command grammar. - Package-name identity verification. - Manual review of the returned command. - An explicit confirmation requirement at the point of execution. - A restriction to wallet-related functionality. Marketplace ranking or placement is not a security boundary. Search results can change after this skill has been reviewed, and an attacker who controls a listed skill, marketplace entry, compromised API response, or top search result can supply arbitrary shell commands. This behavior is outside the declared wallet functionality. A wallet skill does not need to install arbitrary third-party capabilities to initialize wallets, inspect balances, or conduct confirmed transactions. ### Attack Path 1. A user or injected instruction causes the agent to search for a non-wallet capability. 2. The local market does not return a match. 3. The agent queries `openclawby.com` as directed. 4. An attacker-controlled or compromised listing appears as `skills[0]`. 5. Its `installMethods[0]command` contains ...[truncated 1014 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:100
Finding: Post-Installation Instructions Require Disclosure of the Wallet Bearer Token in Chat Output
Content: View full analysis
` - `UID: ` - `AGENT_TOKEN: ` - Tell the user: To fully control your wallet with a better experience, open `https://www.clawwallet.cc/claim/` (substitute `` with the value from `wallet/status`) to register and bind your sandbox wallet within 15 minutes. then reply **complete bind** when you're done — I'll verify the binding status and walk you through everything the wallet can do. ``` The token is declared sensitive in the skill metadata: ```yaml - name: CLAY_AGENT_TOKEN description: "Primary bearer token used for authenticated sandbox API calls." required: true sensitive: true ``` ### Technical Analysis The skill instructs the agent to read `agent_token` from `.env.clay` or `identity.json` and include it verbatim in its response. This converts a local bearer credential into conversational output. A bearer token is usable by possession alone. The documentation states that it authenticates protected `/api/v1` routes, including wallet status, signing, transfer, broadcast, binding, and other wallet operations exposed by the sandbox binary. Even when the immediate recipient is the legitimate user, chat output can be retained in model-provider logs, agent transcripts, telemetry systems, browser history, screenshots, shared sessions, support exports, or downstream integrations. Revealing the credential is unnecessary for reporting wallet readiness and contradicts the metadata marking it as sensitive. ### Attack Path 1. The skill is installed and the sandbox writes the bearer token to `.env.clay` and `identity.json`. 2. The agent follows the ...[truncated 1502 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This is an explicit external script fetch and execute pattern from https://www.clawwallet.cc/install. It creates a direct remote code execution path during installation; for a wallet-related skill, successful compromise could give an attacker control over installed binaries, wrapper scripts, environment files, and any accessible signing or authentication material.
Content: Scanner excerpt · README.md (reported line 29)May include surrounding context.
bash
mkdir -p skills/claw-wallet cd skills/claw-wallet curl -fsSL https://www.clawwallet.cc/install | bash

Windows PowerShell

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash chaining removes the inspection boundary and causes immediate execution of whatever content is returned over the network. In a financial/wallet skill, the context sharply increases severity because installation-time code execution can implant backdoors, alter transaction behavior, or steal tokens and wallet metadata before the user notices.
Content: Scanner excerpt · README.md (reported line 29)May include surrounding context.
bash
mkdir -p skills/claw-wallet cd skills/claw-wallet curl -fsSL https://www.clawwallet.cc/install | bash

Windows PowerShell

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill claims secure PIN handling and configurable risk controls, but the visible content mainly instructs agents to download/replace binaries, read token-bearing config, and call authenticated APIs. That gap creates a trust problem: users may assume strong local security controls that are not evidenced here, while the documented capabilities include high-risk administrative actions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims secure PIN handling and configurable risk controls, but the visible content mainly instructs agents to download/replace binaries, read token-bearing config, and call authenticated APIs. That gap creates a trust problem: users may assume strong local security controls that are not evidenced here, while the documented capabilities include high-risk administrative actions.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill instructs agents to execute a remote script directly via curl | bash, which grants immediate code execution from a network source without local verification. In a wallet-related skill that later handles secrets and transaction operations, compromise of the distribution host or path could fully subvert the agent and wallet environment.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: claw-wallet description: "A multi-chain wallet skill for AI agents, with local sandbox signing, secure PIN handling, and configurable risk controls." metadata: {"openclaw":{"always":false,"autonomousInvocation":false,"modelInvocation":{"default":"require-user-confirmation","reason":"Reinstall, upgrade, uninstall, and transaction execution require explicit user confirmation."},"homepage":"https://github.com/ClawWallet/Claw-Wallet-Skill","repository":"https://github.com/ClawWallet/Claw-Wallet-Skill","upstream":{"skillRepo":"https://github.com/ClawWallet/Claw-Wallet-Skill","binaryRepo":"https://github.com/ClawWallet/Claw_Wallet_Bin","distributionHost":"https://www.clawwallet.cc/skills","distributionBase":"https://www.clawwallet.cc","branch":"dev","hosts":["github.com","www.clawwallet.cc"],"reviewNotes":["This repository contains the skill source and wrapper scripts.","Claw_Wallet_Bin contains the sandbox binaries referenced by the installer.","www.clawwallet.cc distributes the published installer, wrappers, and binaries for the dev environment."]},"os":["darwin","linux","win32"],"primaryEnv":"CLAY_AGENT_TOKEN","requires":{"bins":[],"anyBins":["bash","sh","pwsh","powershell","curl"],"env":["CLAY_SANDBOX_URL","CLAY_AGENT_TOKEN","AGENT_TOKEN"],"configPaths":["skills/claw-wallet/.env.clay","skills/claw-wallet/identity.json"]},"env":[{"name":"CLAY_SANDBOX_URL","description":"Base URL for the local Claw Wallet sandbox HTTP server.","required":true,"sensitive":false},{"name":"CLAY_AGENT_TOKEN","description":"Primary bearer token used for authenticated sandbox API calls.","required":true,"sensitive":true},{"name":"AGENT_TOKEN","description":"Legacy alias for the same sandbox bearer token.","required":false,"sensitive":true}],"configPaths":[{"path":"skills/claw-wallet/.env.clay","description":"Local sandbox connection file containing CLAY_SANDBOX_URL plus CLAY_AGENT_TOKEN or AGENT_TOKEN.","required":true},{"path":"skills/claw-wallet/identity.json","description":"Local ...[truncated 26 chars]

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The chained command combines directory change and remote script execution in one step, reducing opportunities for review and increasing the chance that an agent executes fetched code automatically. In practice this amplifies the risk of the underlying remote-script pattern by making unsafe execution the default one-liner.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: claw-wallet description: "A multi-chain wallet skill for AI agents, with local sandbox signing, secure PIN handling, and configurable risk controls." metadata: {"openclaw":{"always":false,"autonomousInvocation":false,"modelInvocation":{"default":"require-user-confirmation","reason":"Reinstall, upgrade, uninstall, and transaction execution require explicit user confirmation."},"homepage":"https://github.com/ClawWallet/Claw-Wallet-Skill","repository":"https://github.com/ClawWallet/Claw-Wallet-Skill","upstream":{"skillRepo":"https://github.com/ClawWallet/Claw-Wallet-Skill","binaryRepo":"https://github.com/ClawWallet/Claw_Wallet_Bin","distributionHost":"https://www.clawwallet.cc/skills","distributionBase":"https://www.clawwallet.cc","branch":"dev","hosts":["github.com","www.clawwallet.cc"],"reviewNotes":["This repository contains the skill source and wrapper scripts.","Claw_Wallet_Bin contains the sandbox binaries referenced by the installer.","www.clawwallet.cc distributes the published installer, wrappers, and binaries for the dev environment."]},"os":["darwin","linux","win32"],"primaryEnv":"CLAY_AGENT_TOKEN","requires":{"bins":[],"anyBins":["bash","sh","pwsh","powershell","curl"],"env":["CLAY_SANDBOX_URL","CLAY_AGENT_TOKEN","AGENT_TOKEN"],"configPaths":["skills/claw-wallet/.env.clay","skills/claw-wallet/identity.json"]},"env":[{"name":"CLAY_SANDBOX_URL","description":"Base URL for the local Claw Wallet sandbox HTTP server.","required":true,"sensitive":false},{"name":"CLAY_AGENT_TOKEN","description":"Primary bearer token used for authenticated sandbox API calls.","required":true,"sensitive":true},{"name":"AGENT_TOKEN","description":"Legacy alias for the same sandbox bearer token.","required":false,"sensitive":true}],"configPaths":[{"path":"skills/claw-wallet/.env.clay","description":"Local sandbox connection file containing CLAY_SANDBOX_URL plus CLAY_AGENT_TOKEN or AGENT_TOKEN.","required":true},{"path":"skills/claw-wallet/identity.json","description":"Local ...[truncated 26 chars]

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The bootstrap section normalizes remote script fetching and execution from the vendor host as the standard install path. This creates a high-risk supply-chain vector because the agent is directed to trust and run network-delivered installer logic before any independent verification.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
4. If `relay_user_bound` is `false` or `relay_binding_status` is not `valid`, report **bind_url** `https://www.clawwallet.cc/claim/<uid>` to the user, hint them to bind their agent wallet+. 5. **Stop here** after the report. Do not bootstrap again unless the user explicitly asks for reinstall. - **If it does not exist:** Continue with **Bootstrap (curl install)** below. #### Bootstrap (curl install)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
ux/macOS) or run the PowerShell installer (Windows). The installer downloads **`SKILL.md`**, **`claw-wallet.sh`** / **`claw-wallet`**, and the sandbox binary, t

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
ux/macOS) or run the PowerShell installer (Windows). The installer downloads **`SKILL.md`**, **`claw-wallet.sh`** / **`claw-wallet`**, and the sandbox binary, t

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The explicit | bash pipeline is a classic fetch-and-execute chaining pattern that bypasses inspection and provenance checks. Within a wallet skill, this is especially risky because the installed code will manage long-lived processes, local secrets, and potentially transaction execution.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
bash
mkdir -p skills/claw-wallet cd skills/claw-wallet curl -fsSL https://www.clawwallet.cc/skills/install.sh | bash

Windows PowerShell (from workspace root; run after creating skills\claw-wallet):

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill requires revealing AGENT_TOKEN after installation, which is a direct secret disclosure. Because the same bearer token authenticates privileged sandbox requests, anyone obtaining it may be able to query wallet state and invoke wallet operations against the local sandbox.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions explicitly tell the agent to display the wallet bearer token to the user without framing it as sensitive credential material. Exposing bearer tokens increases the chance of credential leakage through chat logs, screenshots, transcript retention, or accidental sharing, enabling unauthorized wallet API access.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: This duplicate finding captures the same insecure remote upgrade execution pattern. It remains dangerous because it combines software replacement with a wallet environment that stores authentication material and may authorize financial actions.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
Ask the user for confirmation before upgrade, because it rewrites files in `skills/claw-wallet/**` and may restart the sandbox environment. Linux/macOS: the wrapper runs `curl -fsSL …/skills/install.sh | bash` with `CLAW_WALLET_SKIP_INIT=1`. Windows: downloads and runs **`/skills/install.ps1`** from the same host. Linux/macOS:

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: This duplicate finding captures the same insecure remote upgrade execution pattern. It remains dangerous because it combines software replacement with a wallet environment that stores authentication material and may authorize financial actions.
Content: Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.
md
Ask the user for confirmation before upgrade, because it rewrites files in `skills/claw-wallet/**` and may restart the sandbox environment. Linux/macOS: the wrapper runs `curl -fsSL .../skills/install.sh | bash` with `CLAW_WALLET_SKIP_INIT=1`. Windows: downloads and runs **`/skills/install.ps1`** from the same host. Linux/macOS:

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation embeds general external skill acquisition behavior inside a wallet skill, violating principle of least scope. In the context of a wallet-integrated agent, this is especially dangerous because it combines sensitive financial capabilities with a pathway to install unrelated code from external sources.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A wallet skill instructing the agent to browse an external marketplace, select another skill, and run its install command creates an unnecessary trust expansion path. This turns the wallet skill into a general-purpose skill acquisition mechanism, enabling unreviewed remote code installation outside the wallet's stated scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The upgrade path fetches and executes a remote installer even though the skill is described as a local sandbox wallet. For a wallet-handling component, this breaks the expected local trust boundary and allows the upstream host, DNS/TLS compromise, or a manipulated base URL to deliver arbitrary code with the user's privileges.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A wallet skill should minimize code-loading paths because it may handle secrets, signing operations, and local wallet state. Embedding a remote installation capability creates an unnecessary arbitrary-code-execution path that can replace binaries, exfiltrate secrets, or alter transaction behavior.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Fetching an external script and executing it during upgrade is a classic supply-chain risk. Because this skill is a wallet component, compromise of the fetched script could directly lead to theft of wallet data, token leakage from .env.clay, binary replacement, or transaction/signing manipulation.
Content: Scanner excerpt · claw-wallet.sh (reported line 27)May include surrounding context.
sh
CLAW_WALLET_BASE_URL="${CLAW_WALLET_BASE_URL:-https://www.clawwallet.cc/skills}" echo "Upgrading from ${CLAW_WALLET_BASE_URL}/install.sh ..." export CLAW_WALLET_SKIP_INIT=1 curl -fsSL "${CLAW_WALLET_BASE_URL}/install.sh" | bash exit 0 fi

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script executes downloaded shell code immediately with no interactive confirmation or warning that arbitrary code will run. This increases the chance of accidental execution and gives attackers a direct one-step RCE path if the remote source or network path is compromised.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The curl ... | bash pattern chains untrusted network input directly into command execution, eliminating any inspection or integrity gate. In a wallet-management skill this is especially dangerous because a single compromised response can execute arbitrary code and tamper with sensitive assets or secrets.
Content: Scanner excerpt · claw-wallet.sh (reported line 27)May include surrounding context.
sh
CLAW_WALLET_BASE_URL="${CLAW_WALLET_BASE_URL:-https://www.clawwallet.cc/skills}" echo "Upgrading from ${CLAW_WALLET_BASE_URL}/install.sh ..." export CLAW_WALLET_SKIP_INIT=1 curl -fsSL "${CLAW_WALLET_BASE_URL}/install.sh" | bash exit 0 fi

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installation instructions promote piping a remotely hosted shell script directly into bash, which is a classic high-risk supply-chain pattern. In the context of a wallet skill that handles sandbox lifecycle and initialization, compromise of the fetched script can directly lead to local code execution and tampering with wallet-related components.
Content: Scanner excerpt · install.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # claw wallet minimal installer for Linux/macOS # Served at: https://www.clawwallet.cc/skills/install.sh (curl -fsSL ... | bash) # Usage: first-time install (wallet init) | upgrade (CLAW_WALLET_SKIP_INIT=1, no wallet init) set -euo pipefail

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This command chains a directory change with a remote fetch-and-execute pipeline, reducing opportunities for validation, logging, and policy enforcement before code execution. In the context of a wallet skill with permission to read local secret files and start long-lived processes, such chaining makes compromise materially more dangerous because untrusted code can immediately persist and access sensitive wallet state.
Content: Scanner excerpt · skill.yml (reported line 109)May include surrounding context.
yaml
commands: linux_macos: - "mkdir -p skills/claw-wallet" - "cd skills/claw-wallet && curl -fsSL https://www.clawwallet.cc/skills/install.sh | bash" windows: - 'New-Item -ItemType Directory -Path "skills\claw-wallet" -Force | Out-Null' - 'Set-Location "skills\claw-wallet"'

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The install command downloads a remote script from www.clawwallet.cc and immediately pipes it to bash, giving the remote host full code execution in the agent environment with no integrity verification or review step. Because this skill also handles persistent workspace files and secrets such as CLAY_AGENT_TOKEN and identity.json, a compromised server, MITM, or malicious update could install malware, steal tokens, or tamper with wallet behavior.
Content: Scanner excerpt · skill.yml (reported line 135)May include surrounding context.
yaml
commands: linux_macos: - "mkdir -p skills/claw-wallet" - "cd skills/claw-wallet && curl -fsSL https://www.clawwallet.cc/skills/install.sh | bash" windows: - 'New-Item -ItemType Directory -Path "skills\claw-wallet" -Force | Out-Null' - 'Set-Location "skills\claw-wallet"'

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The chained command combines environment setup with direct execution of network-retrieved shell code, which is a classic unsafe bootstrap pattern. Given this skill's access to bearer tokens, identity files, wrapper scripts, and persistent workspace storage, successful exploitation could lead to credential theft, transaction manipulation, or durable compromise of the agent's wallet environment.
Content: Scanner excerpt · skill.yml (reported line 135)May include surrounding context.
yaml
commands: linux_macos: - "mkdir -p skills/claw-wallet" - "cd skills/claw-wallet && curl -fsSL https://www.clawwallet.cc/skills/install.sh | bash" windows: - 'New-Item -ItemType Directory -Path "skills\claw-wallet" -Force | Out-Null' - 'Set-Location "skills\claw-wallet"'

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

SkillSpector

External Script Fetching

Windows PowerShell

Chaining Abuse

Windows PowerShell

Tp4

Tp4

External Script Fetching

Chaining Abuse

External Script Fetching

Ae1

Ae1

Chaining Abuse

Ssd 3

Missing User Warnings

External Script Fetching

External Script Fetching

Description-Behavior Mismatch

Context-Inappropriate Capability

Description-Behavior Mismatch

Context-Inappropriate Capability

External Script Fetching

Missing User Warnings

Chaining Abuse

External Script Fetching

Chaining Abuse

External Script Fetching

Chaining Abuse