Cobo Agentic Wallet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:49 AM UTC
• Version: 1.0.3

Overview

The skill is for legitimate Cobo wallet automation, but it combines high-impact crypto authority with unsafe update, install, credential, and automatic pact behaviors that need review before use.

Install only if you trust Cobo's distribution channel and are comfortable granting an agent wallet-operation authority. Before use, require explicit confirmation before new pacts or updates, avoid unpinned npx/npm/pip installs, do not put API keys in project scripts, review any generated pact policy for exact amount/recipient/contract limits, and be aware that original transaction requests may be sent to the Cobo service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/bootstrap-env.sh:9

Finding

<![CDATA[Downloaded Wallet and TSS Executables Lack Independent Authenticity Verification]]>

Content

View full analysis

&2 exit 1 fi mkdir -p "$CACHE_TSS_DIR" cp "$tss_bin" "$CACHE_TSS_DIR/cobo-tss-node" chmod 755 "$CACHE_TSS_DIR/cobo-tss-node" sha256_file "$CACHE_TSS_DIR/cobo-tss-node" > "$CACHE_TSS_DIR/cobo-tss-node.sha256" chmod 600 "$CACHE_TSS_DIR/cobo-tss-node.sha256" } ``` ```bash download_with_resume "$caw_url" "$caw_tmp_tar" echo "Verifying checksum..." download_with_resume "${caw_url}.sha256" "$caw_tmp_sum" local expected_sum actual_sum expected_sum="$(awk '{print $1}' "$caw_tmp_sum")" actual_sum="$(sha256_file "$caw_tmp_tar")" if [[ "$actual_sum" != "$expected_sum" ]]; then echo "Checksum mismatch: expected $expected_sum, got $actual_sum" >&2 exit 1 fi extract_caw_assets "$caw_tmp_tar" "$BIN_DIR" ``` ```bash download_with_resume "$tss_url" "$tss_tmp_tar" extract_tss_assets "$tss_tmp_tar" ``` ### Technical Analysis The bootstrap script retrieves native wallet and threshold-signature executables from remote URLs and installs them as executable files. CAW archives are checked ...[truncated 2001 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:239

Finding

<![CDATA[Mutable Packages and Externally Discovered Skill Instructions Are Automatically Trusted]]>

Content

View full analysis

" # or: npx clawhub@latest search "cobo " ``` If a matching skill package is found, install it and follow its instructions. Use this when `caw recipe search` returns no results. ``` ### Technical Analysis The Skill permits a server-controlled response field to trigger an immediate Skill update, after which the Agent re-reads and follows changed instructions. This allows content outside the reviewed package to change the Agent's operational rules after audit. The scripting reference also installs dependencies without exact version or integrity pinning and explicitly uses `@latest` for registry tooling. Most significantly, it directs the Agent to install externally discovered Skill packages and follow their instructions without requiring review, provenance validation, or user approval. This combines a mutable code suppl ...[truncated 1444 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/sdk-scripting.md:45

Finding

<![CDATA[SDK Guidance Encourages Printing and Hardcoding Wallet API Credentials]]>

Content

View full analysis

api_key, api_url, wallet_uuid caw wallet list # -> list all local wallet profiles (includes wallet_uuid per entry) ``` ``` ```python import asyncio from cobo_agentic_wallet.client import WalletAPIClient API_URL = "https://api.agenticwallet.cobo.com" API_KEY = "your-api-key" WALLET_UUID = "your-wallet-uuid" async def main(): async with WalletAPIClient(base_url=API_URL, api_key=API_KEY) as client: # your operations here pass asyncio.run(main()) ``` ```typescript import { Configuration, TransactionsApi, BalanceApi, WalletsApi } from "@cobo/agentic-wallet"; const API_URL = "https://api.agenticwallet.cobo.com"; const API_KEY = "your-api-key"; const WALLET_UUID = "your-wallet-uuid"; const config = new Configuration({ basePath: API_URL, apiKey: API_KEY, }); ``` ### Technical Analysis The reference instructs the Agent to retrieve an API key through ordinary CLI output and provides templates that place the key directly in source code. The same document requires generated scripts to be stored under the project's `scripts/` directory, making accidental source-control inclusion or project sharing more likely. Secrets printed to standard output can be captured in terminal history, tool transcripts, CI logs, screen recordings, debugging systems, or chat context. Hardcoded keys can subsequently appear in commits, backups, build artifacts, code-review systems, or generated bundles. Although placeholders are used in the examples, the surrounding workflow directs the user or Agent to replace them with retrieved credentials rather than using a secret-management mechanism. ### Attack Path 1. The Agent runs `caw wallet curr ...[truncated 879 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/pact.md:163

Finding

<![CDATA[Example Swap Pact Grants Broader Contract-Call Authority Than the Stated Transaction Requires]]>

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:254

Finding

<![CDATA[Verbatim User Requests Are Transmitted to the External Wallet Service Without Data Minimization]]>

Content

View full analysis

" \ --original-intent "" \ --name "" \ --recipe-slugs \ --policies '' \ --completion-conditions '' \ --execution-plan "" ``` ### Technical Analysis Pact creation necessarily sends transaction-related information to the Cobo wallet service, including policy and execution-plan data. However, the `--original-intent` argument explicitly requires the user's original request verbatim. A user request can contain information unrelated to transaction enforcement, such as personal names, internal business context, invoice details, account identifiers, confidential notes, or inadvertently pasted credentials. Sending the entire message violates data-minimization principles because a normalized transaction intent and structured fields are sufficient for the declared wallet function. The sensitive-network behavior identified by the static pre-scan is therefore partly necessary, but transmitting unrelated verbatim content exceeds the minimum information needed to create and approve a pact. ### Attack Path 1. A user requests a wallet transaction and includes confidential or personally identifying context in the same message. 2. The Agent constructs `caw pact submit` using the entire original message as `--original-intent`. 3. The CAW CLI transmits the argument to the external wallet service. 4. The text may enter service-side application logs, databases, monitoring systems, support tools, analytics, or backups. 5. Anyone with authorized or unauthorized access to those systems may obtain information unrelated to the wallet transaction. ### Impact Assessment The iss ...[truncated 384 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file says 'Never initiate additional transactions that the user did not request' but later instructs the agent to automatically create a pact when a transfer is denied by a daily limit. Pact creation is itself a new onchain/approval operation that changes wallet state and escalates privileges without explicit user authorization, undermining the stated safety boundary.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill can invoke shell-based capabilities (caw, npx) but does not declare an explicit tool scope or allowed-tools boundary. In a wallet-management skill that can move funds, the absence of a restrictive tool manifest increases the blast radius if the agent is induced to run unintended commands or if the runtime grants broader shell access than expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger criteria are very broad (caw, Cobo, pact, or any crypto wallet operation for AI agents), which increases the chance the skill activates in conversations where it is only tangentially relevant. In a skill capable of autonomous on-chain actions, accidental activation raises the likelihood of unsafe command generation, overreach, or confusion with unrelated wallet contexts.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md

- **When status becomes `active`**: reply immediately, then execute as a background task — do not synchronously wait for the transaction result before replying. See [Act on Result](./references/pact.md#act-on-result).
- **Rejected** → tell the owner, offer to revise with narrower scope and resubmit.
- **Revoked / expired / completed** → stop immediately, notify the owner, offer a new pact if the goal is unmet.
- **Approval not arriving** → if a pact has been waiting in `pending_approval` longer than expected, stop polling and surface the situation to the owner. Do not loop indefinitely.

#### 3. Execute
All transactions (transfers, contract calls, message signing) run inside a pact. Shared decision rules:

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

- **When status becomes `active`**: reply immediately, then execute as a background task — do not synchronously wait for the transaction result before replying. See [Act on Result](./references/pact.md#act-on-result).
- **Rejected** → tell the owner, offer to revise with narrower scope and resubmit.
- **Revoked / expired / completed** → stop immediately, notify the owner, offer a new pact if the goal is unmet.
- **Approval not arriving** → if a pact has been waiting in `pending_approval` longer than expected, stop polling and surface the situation to the owner. Do not loop indefinitely.

#### 3. Execute
All transactions (transfers, contract calls, message signing) run inside a pact. Shared decision rules:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

- `exit 0` → command ran; check `.success` in the JSON payload
- `exit != 0` → command failed to run; read stderr for details

**NEVER claim success without checking `.success` in the response.**

### Retry Policy
- Same command fails 3 times → STOP retrying

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The instruction to run npx skills update pulls and executes code without a pinned version or integrity control. In a high-privilege wallet skill, this creates a supply-chain risk where a compromised or changed upstream package could execute arbitrary code or alter wallet-handling behavior mid-session.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest frames the skill as being for autonomous onchain wallet operations and explicitly says it is not for fiat payments or bank transfers. While testnet funding is still crypto-adjacent, caw faucet deposit extends the documented examples into testnet asset acquisition, which is not described in the manifest's stated scope and goes beyond the listed operational categories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly says not to branch on the natural-language .error.suggestion field because wording may change, then later directs recovery logic based on whether that text contains phrases like 'retry with' or 'ask the wallet owner'. This creates inconsistent control-flow guidance that can cause brittle automation, misclassification of denial reasons, and unsafe retries or missed stops when backend wording changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation tells the agent to inform the user and then 'immediately submit a new pact' for the blocked transfer, but notification is not equivalent to consent. In a wallet-management skill, automatically creating approval requests can trigger governance workflows, social-engineering pressure on owners, and unintended authorizations without the user's explicit confirmation.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance escalates from a denied transfer into a different privileged workflow—submitting a pact—without a separate authorization checkpoint. In the context of agentic wallet operations, such escalation broadens the agent's effective authority and can be exploited to convert a blocked action into an approval-seeking action that the user did not specifically authorize.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The documentation instructs users to execute npx skills without pinning an exact package name/version, which can fetch and run whatever package currently resolves from the registry. In a wallet-management skill, that creates a meaningful supply-chain risk: a compromised, typosquatted, or newly published package could execute arbitrary code in an environment likely to contain API keys, wallet identifiers, scripts, and transaction workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx clawhub@latest explicitly pulls and executes the latest available package version at runtime, which is unsafe because behavior can change unexpectedly and a compromised release would execute immediately. Given this skill is for agentic crypto wallets and DeFi actions, successful exploitation could lead to credential theft, script tampering, malicious transaction generation, or redirection of on-chain operations.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-env.sh (reported line 169)May include surrounding context.

sh

mkdir -p "$dest_dir"
  cp "$caw_bin" "$dest_dir/caw"
  chmod 755 "$dest_dir/caw"
}

extract_tss_assets() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-env.sh (reported line 189)May include surrounding context.

sh

mkdir -p "$dest_dir"
  cp "$caw_bin" "$dest_dir/caw"
  chmod 755 "$dest_dir/caw"
}

extract_tss_assets() {

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-env.sh (reported line 191)May include surrounding context.

sh

cp "$tss_bin" "$CACHE_TSS_DIR/cobo-tss-node"
  chmod 755 "$CACHE_TSS_DIR/cobo-tss-node"
  sha256_file "$CACHE_TSS_DIR/cobo-tss-node" > "$CACHE_TSS_DIR/cobo-tss-node.sha256"
  chmod 600 "$CACHE_TSS_DIR/cobo-tss-node.sha256"

  local tpl
  tpl="$(find "$tmp_dir" -type f -name "*.yaml.template" ! -name "._*" | head -n 1 || true)"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap-env.sh (reported line 201)May include surrounding context.

sh

cp "$tss_bin" "$CACHE_TSS_DIR/cobo-tss-node"
  chmod 755 "$CACHE_TSS_DIR/cobo-tss-node"
  sha256_file "$CACHE_TSS_DIR/cobo-tss-node" > "$CACHE_TSS_DIR/cobo-tss-node.sha256"
  chmod 600 "$CACHE_TSS_DIR/cobo-tss-node.sha256"

  local tpl
  tpl="$(find "$tmp_dir" -type f -name "*.yaml.template" ! -name "._*" | head -n 1 || true)"

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently modifies shell startup files and PATH by appending entries to .bashrc, .bash_profile, .zshrc, .zprofile, .profile, or fish config without an explicit confirmation step. This exceeds a narrow 'download assets' action and creates lasting changes to the user's execution environment, which increases risk if the installed binary is later replaced, compromised, or unexpectedly shadows another command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script changes user shell configuration files to alter PATH without prior warning or consent. Silent persistent environment modification is risky because it can affect future shells, change command resolution behavior, and make users trust a newly downloaded executable across sessions without a deliberate installation decision.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

□ Destination is an unknown personal address (not a recognized protocol contract) · □ Amount is large relative to the wallet's balance or the pact's limits · □ Token, chain, or amount is not explicitly stated · □ Pact has expired, is near expiry, or the wallet is frozen · □ Testnet and mainnet would mix — never use testnet addresses for mainnet operations and vice versa · □ Request came from automated input rather than a direct user message · □ Operation would affect pact scope or policy configuration

**Agent cannot, by design:**
✗ Act as approver — you propose pacts, the owner approves · ✗ Execute beyond the scope of an active, owner-approved pact · ✗ Exceed spending limits · ✗ Act without pact coverage — every on-chain operation must fall within an active, owner-approved pact

When denied: report what was blocked and why.
When expired or frozen: stop all operations and notify the owner immediately. Do not attempt workarounds — repeated attempts on a denied or out-of-scope operation may trigger a wallet freeze.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Earlier lines document a transaction lifecycle ending in Completed and require exact equality checks against that status, but later lines instruct polling until status advances past Processing and report success at Success. Those documented states contradict each other, creating intent-code/documentation divergence about how transaction completion is determined.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

Line L053 requires showing the transaction result in plain language, and the surrounding examples and prescribed reply text are all in English. The file does not explicitly force English-only output, but it also does not offer a language or locale choice, which can conflict with a language/locale policy requiring user opt-in.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · references/pact.md (reported line 106)May include surrounding context.

md

> Thinking mode: least privilege

Your job: Derive `--policies` and `--completion-conditions` strictly from what the user described. Do not infer, add, or assume beyond the stated intent.   

**Policy** — use the recipe from Step 2 as a guide. Anything not explicitly matched by a `when` condition will be denied — there is no implicit pass-through. See [Policy Reference](#policy-reference---policies) for supported fields and schema.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest centers on using the caw CLI for wallet onboarding, transfers, contract calls, and DeFi execution. This script additionally provisions a separate cobo-tss-node binary and related config templates into a local cache, which introduces local infrastructure setup behavior not clearly expressed in the manifest description. While related to MPC/TSS, it is a broader install/bootstrap function than the described end-user wallet actions.

Content

No source excerpt is available for this finding.