FluxA-agent-wallet

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:50 AM UTC
• Version: 1.4.5

Overview

This real-money wallet skill is broadly purpose-aligned, but it needs Review because it exposes highly sensitive payment authority and credentials with under-scoped controls.

Install only if you are comfortable giving an agent access to real-money wallet workflows. Before use, require explicit confirmation for every transfer, payout, card action, paid API call, and mandate reuse; avoid revealing raw card details to the agent; pin any CLI/package versions; disable scheduled check-ins unless you have reviewed them; and treat tokens, JWTs, payment headers, payer emails, and mandate files as sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The document expands a wallet/payment skill into a social-networking workflow, including friend discovery and social posting. In the context of an agent wallet, this is dangerous because it encourages actions outside the declared scope and can create hidden side effects that lead to identity linkage, unintended follows, and eventual fund transfers to socially discovered contacts.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The step-by-step guide instructs the agent to register an external service, create posts, follow accounts, and claim red-packets, none of which are core wallet operations described in the manifest. For an autonomous agent with wallet access, this scope creep is risky because it can drive the agent into unreviewed third-party interactions that may culminate in financial actions or data disclosure without sufficiently specific user intent.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The file materially expands the skill from wallet/payment operations into a broader identity and authentication system for AI agents, including registration, credential issuance, token refresh, and third-party JWT verification guidance. In a payment-capable skill, undocumented identity/auth features increase attack surface, create scope creep, and may cause downstream agents or integrators to grant this skill broader trust than its declared purpose warrants.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: This section teaches integrators to rely on a general bearer-JWT authentication framework tied to the skill's infrastructure, which is outside the stated wallet/payment scope and could be repurposed for broader agent impersonation or trust establishment across services. In the context of a wallet skill, introducing reusable authentication primitives is more dangerous because payment-enabled agents already handle sensitive actions, so extra identity authority can enable privilege expansion across unrelated systems.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill’s manifested wallet scope expands beyond ordinary payment actions into issuing prepaid cards, and elsewhere the skill documents retrieval of full card details. That materially broadens what an agent can do with user funds and introduces highly sensitive payment instruments that can be abused for unauthorized purchases or exfiltration.

Context-Inappropriate Capability

Critical

• Confidence: 100% confidence
• Finding: The documented `card details --id` command reveals full PAN, CVV, and expiry, which are full payment credentials. Exposing those secrets to an AI agent or its surrounding tooling is extremely dangerous because they can be logged, cached, leaked to other tools, or used directly for fraudulent transactions.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The manifest description omits that the skill can issue agent identity credentials to third parties, while the body later includes `agent-vc` capability. This hidden scope expansion undermines informed consent and could cause the skill to be invoked in contexts where identity attestation to external services was not expected.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The description states that the app can transfer funds to friends on the user's behalf but does not pair that capability with a clear warning about consent, transaction review, recipient verification, or spending limits. In a wallet-enabled agent context, omitting those warnings increases the chance of users and downstream agents treating socially induced transfers as routine, which can lead to unauthorized or manipulated payments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The instructions encourage following accounts and claiming red-packets without warning that these actions may expose the user's account to scams, spam, social engineering, or induce later financial interactions. Because the same skill environment includes wallet capabilities, incentivized social actions are especially dangerous: they can be used as a funnel into malicious payment requests or deceptive reward claims.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide tells users to save `agent_id`, `token`, and `jwt` but does not label them as secrets or provide any secure storage and handling guidance. In a wallet and payment context, these credentials could enable unauthorized registration, payment-link operations, or impersonation if exposed through logs, source control, screenshots, or insecure local storage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The policy instructs the agent to persist mandate metadata in a local file across conversations, but it provides no requirement to notify the user, obtain consent, or describe retention and access characteristics. In a wallet/payment context, even metadata such as mandate IDs, scopes, spending purposes, limits, and validity windows can reveal sensitive financial behavior and create privacy and operational risk if stored unexpectedly or accessed by other local processes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly exposes `payerEmail` in received payment records but provides no privacy, minimization, retention, or consent guidance. In a wallet/payment skill, this can encourage agents or integrators to collect, display, log, or repurpose personally identifiable information beyond what is necessary, increasing privacy and compliance risk.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest says to use this tool whenever the user asks for payment-related actions, which is broad and underspecified for a skill that can transfer funds, create payment links, and access card features. Overbroad activation language increases the chance an agent invokes the wallet in situations that do not warrant such high-risk capabilities.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The repeated instruction to use the tool for payment-related actions reinforces ambiguous auto-activation without clarifying safety boundaries. In a high-risk wallet skill, repeated broad language can bias agents toward overuse and unnecessary access to fund-moving or credential-revealing commands.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The skill presents itself as a secure wallet assistant but does not prominently warn that it can send funds, create charges, issue prepaid cards, reveal full card credentials, and attest identity to third parties. Missing upfront risk disclosure can mislead users and integrators about the sensitivity of the tool and reduce informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The file provides concrete step-by-step instructions for initiating an irreversible USDC transfer but does not require an explicit confirmation step, warning that funds are irreversible, or guidance to independently verify the target agent ID and amount before payment. In an agent-wallet context, this omission is risky because an AI agent may operationalize these instructions and transfer funds to the wrong recipient, a spoofed agent ID, or an attacker-controlled destination with no practical recovery path.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide instructs the agent to discover and call third-party paid APIs and to request wallet budget approval, but it does not require an explicit warning that user data/prompts will be sent to external services or that real charges will be incurred. In a wallet-enabled agent, this omission is materially risky because users may approve spending without understanding the recipient, billing implications, or data-sharing scope.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The example prompt hard-codes a specific nationality/style ('Japanese anime girl') without deriving that choice from user intent, which can steer outputs toward unnecessary demographic attributes and reduce user agency. While not a direct security flaw, it is a genuine safety/policy weakness because the skill is designed to act autonomously and may generate sensitive or biased content defaults without opt-in.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guidance explicitly tells the agent to resend signed payment artifacts to external endpoints but does not warn that these headers are security-sensitive, may authorize value transfer, and must only be sent to the exact intended payee/resource. In a wallet/payment skill, omission of that warning increases the chance an agent forwards reusable or mis-bound payment data to untrusted services, phishing endpoints, logs, or the wrong origin.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: The example writes response headers to /tmp/x402_headers without noting that this creates a local artifact containing payment challenge metadata and target endpoint details. On shared or multi-process environments, predictable files in /tmp can be read, clobbered, or mishandled, and the lack of disclosure makes unsafe operational use more likely.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The documented `x402 details <url>` command will make outbound requests to a user-supplied arbitrary URL while auto-trying multiple HTTP methods until it receives a 402 response. In an agent wallet context, this can be abused for SSRF-style probing, internal service discovery, or contacting sensitive endpoints without clear user awareness, especially because the documentation presents it as a harmless inspection step.

Session Persistence

Medium

• Category: Rogue Agent

Content

- Discover API → pay → generate → poll result (Banana/Seedance)
- Search x402 services → call multiple APIs to compare results

**Strategy:** Estimate the **total cost across all steps** before creating the mandate. Include retry buffer (1 extra attempt per step). Create **one mandate** covering the entire workflow — do NOT create a new mandate per step.

### Type 3 — Recurring / Long-Term Task

• Confidence: 78% confidence
• Finding: Create **one mandate** covering the entire workflow — do NOT create a new mandate per step. ### Type 3 — Recurring / Long-Term Task A task the user will repeat regularly or that the agent expects to

Self-Modification

High

• Category: Rogue Agent

Content

| **Charge Agent** | Receive payments from agents via Payment Link + x402 | [INTEGRATION-GUIDE-CHARGE-AGENT.md](INTEGRATION-GUIDE-CHARGE-AGENT.md) |
| **Payout to External Wallet** | Send USDC to any Base chain wallet address | [INTEGRATION-GUIDE-PAYOUT.md](INTEGRATION-GUIDE-PAYOUT.md) |

## Troubleshooting — Update Skill & CLI

If you encounter persistent errors during payment or other operations that you cannot resolve, the skill or CLI version may be outdated. Update from:

• Confidence: 96% confidence
• Finding: Update Skill

Session Persistence

Medium

• Category: Rogue Agent

Content

**MUST** follow when working with intent mandates:

1. **Plan by task intent, not by API call.** Assess the full task before creating a mandate — estimate total cost across all steps, create one mandate for the whole workflow.
2. **Check for reusable mandates first.** Before creating a new mandate, check both the current conversation context and `~/.fluxa-ai-wallet-mcp/mandates.json` for existing signed, unexpired mandates that fit.

Full planning rules, task classification, and state file schema: [MANDATE-PLANNING.md](MANDATE-PLANNING.md)

• Confidence: 78% confidence
• Finding: create one mandate for the whole workflow. 2. **Check for reusable mandates first.** Before creating a new mandate, check both the current conversation context and `~/.fluxa-ai-wallet-mcp

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.