Security audit

Wallet Balance

Security checks for vulnerabilities and agentic risk

Overview

This wallet-balance skill mostly does what it says, but it stores sensitive wallet addresses in a shared local memory file and exposes unauthenticated endpoints that can list, add, remove, and automatically query them.

Install only if you are comfortable with wallet addresses being stored locally and reused for later balance checks. Run the gateway bound to localhost or behind access controls, avoid shared hosts, review or clear the memory file regularly, and do not save addresses that would reveal sensitive financial relationships.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill metadata says it supports EVM and BTC balances, but the input normalization logic accepts many additional non-EVM address formats and routes them to the MCP backend. This expands the system's real data-access scope beyond what users and reviewers would expect, increasing privacy and trust risk because addresses for many unrelated chains may be collected and transmitted externally.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The memory read endpoint returns all remembered wallet addresses without any authentication or authorization checks. Wallet addresses are sensitive financial metadata, so exposing the full stored list lets any caller enumerate a user's tracked addresses and infer portfolio interests or identity links.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill exposes unauthenticated add/remove operations for remembered addresses, effectively creating a shared mutable address book unrelated to simple balance lookup. An attacker can tamper with stored addresses, pollute future queries, or delete entries, causing privacy issues and integrity problems for subsequent users.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example utterances are broad enough to match common wallet-related speech such as 'What's in my wallet?' or '查我的余额', which can cause the skill to activate in situations where the user did not intend a third-party wallet lookup. Because this skill can query remembered addresses automatically, ambiguous activation increases the chance of unintended balance disclosure or external transmission of wallet addresses.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase describing memory behavior ('say check my balance and all saved addresses are queried automatically') creates an ambiguous trigger tied to a very common user utterance. In an agent environment, this can cause automatic retrieval and disclosure of stored wallet information without a sufficiently explicit user action.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README describes persistent storage of wallet addresses and automatic querying but does not warn users about the privacy implications of storing financial identifiers or automatically reusing them later. Wallet addresses can be sensitive metadata that reveal holdings and transaction history, so silent persistence and reuse can surprise users and expose personal financial information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README states that balance lookups use Antalpha MCP, public RPC providers, Blockstream, and CoinGecko, but it does not clearly warn that user wallet addresses may be sent to these third-party services. This omission matters because wallet addresses are linkable identifiers, and sending them externally can disclose a user's financial relationships and holdings to multiple providers.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill asks to remember wallet addresses, but the user-facing description does not clearly warn that addresses may be stored and reused. Wallet addresses are sensitive financial identifiers, and retaining them without prominent upfront disclosure creates privacy risk, especially when later aggregation can reveal a user's portfolio across chains.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This code persists and removes wallet addresses from long-term memory immediately on API request, with no built-in confirmation, notice, or proof that the user consented to storage. Because wallet addresses are sensitive identifiers, silent persistence can violate user expectations and create privacy exposure if addresses are later enumerated or reused.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The service sends wallet addresses to external providers, including the MCP service and public blockchain/price APIs, without any server-side indication that the user has been informed or has consented. Wallet addresses are sensitive financial metadata, so undisclosed third-party transmission creates privacy and compliance risk, especially because this skill also supports remembering addresses.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: server.js:13