Nad Wallet
ReviewAudited by ClawScan on May 10, 2026.
Overview
The wallet features are mostly disclosed and purpose-aligned, but the scripts handle high-value wallet secrets and have an unsafe wallet-file path pattern that should be reviewed before use.
Review this skill before installing. If you use it, create a dedicated low-value wallet, avoid giving it keys for wallets with funds, use simple wallet names only, and keep all ~/.nad-wallet files private and out of backups or git.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A crafted wallet name could cause wallet files containing private keys and mnemonics to be written outside the intended wallet directory or overwrite an unintended .json file.
The user-controlled wallet name is joined directly into a filesystem path without rejecting path separators or '..', even though the documentation says wallet files should stay under ~/.nad-wallet/.
walletName = args[managedIdx + 1]; ... const filepath = path.join(walletsDir, `${walletName}.json`); ... fs.writeFileSync(filepath, JSON.stringify(walletData, null, 2), { mode: 0o600 });Only use simple wallet names such as letters, numbers, dashes, and underscores; the skill should resolve the path and enforce that it remains inside ~/.nad-wallet/wallets before reading or writing.
Anyone or any agent running these commands with your wallet key can authenticate as that wallet for supported services.
The skill can use a wallet private key from an environment variable or managed wallet file to act as that wallet for SIWE registration.
if (process.env.NAD_PRIVATE_KEY) { ... return new ethers.Wallet(process.env.NAD_PRIVATE_KEY); } ... return new ethers.Wallet(data.privateKey);Use a fresh, low-value dedicated wallet for automation, avoid funded wallets, and expose NAD_PRIVATE_KEY only for the task that needs it.
If the local wallet files are backed up, synced, committed, or read by another process, the wallet can be compromised.
Managed mode persists wallet private keys and mnemonics locally; this is disclosed and opt-in, but the stored values are sensitive long-lived secrets.
privateKey: wallet.privateKey, mnemonic: wallet.mnemonic.phrase, ... fs.writeFileSync(filepath, JSON.stringify(walletData, null, 2), { mode: 0o600 });Prefer environment-variable mode, keep ~/.nad-wallet out of sync and git, back up mnemonics offline, and delete local mnemonic files after secure backup.
A future dependency version change could affect key generation, signing, or transaction behavior.
The wallet code relies on an external crypto library using a broad semver range, and no lockfile or install spec is supplied in the artifacts.
"dependencies": { "ethers": "^6.0.0" }Install with a reviewed lockfile or pin an exact ethers version before using the skill with valuable wallets.