ClawHub
Back to skill

Security audit

Nano starter (receive-only wallet)

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed receive-only Nano wallet skill that stores a local private key and uses a Nano RPC node, with no evidence of hidden execution or fund-sending through the documented command.

Before installing, understand that this creates a real cryptocurrency private key on disk; back it up securely, protect the configured key path, and use a trusted Nano RPC endpoint if you do not want a public/default node to see account queries and signed receive blocks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly creates and persists a private key on disk in a predictable default location, which is a form of session/secret persistence. Even though the file is described as mode 600 and not printed to logs, long-lived local storage of a cryptocurrency private key increases exposure to host compromise, backup leakage, filesystem misconfiguration, or accidental reuse across contexts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Every command prints one JSON object. Run them from this folder.

1. Create the wallet (once)

text
python3 starter.py setup

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code reads a private key file from a user-supplied path and imports the secret into process memory, which is a safety-sensitive operation involving credentials. While the module docstring explains key-handling behavior generally, there is no user-facing prompt, log, or inline warning on this specific load path to disclose that sensitive key material is being accessed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The module documentation states that 'receive-only mode adds nothing' to the network-facing surface, suggesting a limited or non-mutating network role. However, the same file implements process, which publishes signed blocks, and work_generate, which invokes remote work generation, both of which go beyond a purely receive-only interaction model.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · starter.py (reported line 4)May include surrounding context.

python
#!/usr/bin/env python3
"""Nano starter: a receive-only Nano (XNO) wallet for an agent, in one command, with no node.

usage: python3 starter.py setup       create the wallet once (or show the one that exists); prints the address
       python3 starter.py address     print the address
       python3 starter.py balance     balance and what is waiting to be received
       python3 starter.py receive     pocket what is waiting (does the proof-of-work on this machine)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The docstring explicitly states that the private key is never printed, returned, or sent anywhere. However, the receive command loads the key store and passes it to payments.receive together with a network-backed StarterNode, which implies the private key is used to create signed transactions that are then published remotely. Even if the raw key is not directly transmitted, the documentation's broad wording can mislead users about network-affecting use of private-key-backed operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code sends JSON-RPC requests over HTTP to a configured Nano node, including account addresses and other wallet-related request data. Although the module docstring explains that this file touches the network, there is no user-facing confirmation prompt, warning, or runtime disclosure before transmitting data off-machine.

Content

No source excerpt is available for this finding.