Agent Wallet CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:40 PM UTC
• Version: 1.4.0

Overview

This is a coherent crypto-wallet automation skill, but it needs Review because it combines real fund-control authority with an unpinned global CLI install, unsafe secret-handling examples, skipped confirmations, and misleading network-scope claims.

Install only after reviewing the agent-wallet-cli source and npm package provenance. Prefer an isolated machine or container, avoid giving the agent WALLET_PASSWORD or mnemonics, unlock manually, use short-lived session tokens, dry-run first, avoid --yes for meaningful value, set tight x402 maximums, and pin or otherwise verify the CLI version before using real funds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:34
• Finding: Unpinned Global Installation of a Security-Critical Third-Party Package## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 34–36 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"requires":{"bins":["agent-wallet-cli"],"env":["WALLET_PASSWORD (sensitive, optional): Wallet encryption password — passed via --password or piped via stdin. Only needed for init/import/unlock/export.","WALLET_SESSION_TOKEN (sensitive, optional): Time-limited session token (wlt_...) from unlock. Used for all operations via --token."]},"install":[{"id":"agent-wallet-cli","kind":"node","package":"agent-wallet-cli","bins":["agent-wallet-cli"],"label":"Install agent-wallet-cli (npm)"}],"source":{"repository":"https://github.com/donald-jackson/agent-wallet-cli","license":"MIT"}}} ``` ```bash npm install -g agent-wallet-cli ``` ### Technical Analysis The Skill instructs users or agents to install the latest available `agent-wallet-cli` package globally from npm. Neither the installation metadata nor the setup command pins an exact version or package integrity digest. The package is security-critical because the documented workflow gives it access to wallet passwords, recovery mnemonics, session tokens, signing operations, approvals, and cryptocurrency transfers. However, the package implementation is not included in the audited project, so this artifact cannot establish that the package downloaded at installation time matches a reviewed revision of the linked source repository. A package-owner account compromise, registry compromise, package takeover, or malicious future release could therefore substitute code after this Skill has been reviewed. Global installation also makes the resulting executable available outside a project-local dependency boundary and causes its installation lifecycle code to execute with the installing user's privileges. ### Attack Path 1. An attacker compromises the npm package, its publisher ...[truncated 1397 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to an exact, independently audited version rather than installing the latest release. - Verify package integrity using a trusted lockfile and registry integrity digest. - Avoid global installation; use a project-local, isolated installation with minimal operating-system privileges. - Vendor the reviewed source or include it in the audited artifact so the effective implementation can be inspected. - Verify that the published npm package corresponds exactly to a signed source commit or reproducible build. - Disable npm lifecycle scripts where feasible, or inspect them before installation. - Run wallet software in an isolated environment with restricted filesystem and network access. - Establish a controlled upgrade process that requires security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:41
• Finding: Wallet Passwords and Recovery Mnemonics Passed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 41–51 and 63–69 **Vulnerability Type**: Sensitive information exposure through process arguments **Risk Level**: High ### Vulnerable Code ```markdown 1. **Init** (first time): `agent-wallet-cli init --password "$WALLET_PASSWORD"` - Displays mnemonic ONCE — save it securely 2. **Import** (existing wallet): `agent-wallet-cli import --password "$WALLET_PASSWORD" --mnemonic "word1 word2 ..."` 3. **Unlock**: `agent-wallet-cli unlock --password "$WALLET_PASSWORD" --duration 3600` - Returns session token (`wlt_...`) valid for specified duration 4. **Use**: Pass `--token wlt_...` to all commands (no password needed) 5. **Lock**: `agent-wallet-cli lock` when done **Note:** `--password` and `--mnemonic` can be omitted to be prompted securely via stdin (recommended for interactive use). When using in automation, `--password` is accepted but will show a warning about shell history visibility. ``` ```bash agent-wallet-cli init [--password <pw>] [--word-count 12|24] [--name <name>] agent-wallet-cli import [--password <pw>] [--mnemonic "<phrase>"] [--name <name>] agent-wallet-cli unlock [--password <pw>] [--duration <secs>] [--name <name>] agent-wallet-cli lock [--name <name>] agent-wallet-cli export [--password <pw>] --confirm [--name <name>] ``` ### Technical Analysis The primary workflow demonstrates wallet passwords and recovery mnemonics as command-line option values. Although shell variable expansion avoids placing the literal password in the typed command, the expanded value is still supplied in the spawned process's argument vector. The mnemonic is shown directly as an argument. Depending on the operating system and execution environment, process arguments may be exposed through process inspection interfaces, monitoring agents, command auditing, debugging output, automation logs, error reports, or wrapper scripts. Literal mnemonics entered in comma ...[truncated 1901 chars]
• Remediation: ## Remediation Suggestions - Remove password and mnemonic arguments from the recommended workflow and examples. - Require secrets to be read through a protected interactive prompt, dedicated file descriptor, or approved secret-management integration. - For automation, use a mechanism that does not expose secrets in process arguments, such as reading from standard input where safely supported or passing an inherited protected descriptor. - Ensure secret input is not echoed and is never included in normal, debug, or error logs. - Prefer user-generated short-lived session tokens over providing agents with wallet passwords. - Apply strict permissions to wallet files and isolate wallet operations from unrelated local processes and monitoring systems. - Document that mnemonics must never appear in command history, process arguments, environment dumps, CI configuration, or logs. - If a mnemonic may have been exposed, create a new wallet from a new seed and transfer all assets; changing only the encryption password is insufficient.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Session Persistence

Medium

• Category: Rogue Agent

Content

## Security Model

1. **You** create or import a wallet with a password → encrypted on disk in `~/.agent-wallet-cli/`
2. **You** (or the agent) unlock with the password → get a time-limited session token (`wlt_...`)
3. **The agent** uses only the session token — it expires automatically (default 1hr, max 24hr)
4. **No telemetry, no analytics, no server calls** — only public blockchain RPCs for queries and transactions

• Confidence: 84% confidence
• Finding: The skill persists wallet material on disk and uses time-limited session tokens for continued access, which creates a standing-access surface if the host, wallet directory, or environment variables are compromised. In an agent setting, persistence is more sensitive because automated tooling may retain tokens in process state, logs, shell history, or shared runtime environments.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The security model states 'No telemetry, no analytics, no server calls — only public blockchain RPCs,' yet the documented x402 command sends non-RPC HTTP requests. In a wallet-management skill, inaccurate security claims are dangerous because users may grant sensitive tokens or broader trust based on false assumptions about external communication.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

agent-wallet-cli send --token <wlt_...> --chain <chain> --to <addr> --amount <amt> --token-address <addr|alias> --yes [--no-relay]
```

- **`--yes`**: Skip confirmation prompt (required for non-TTY/agent use)
- **`--dry-run`**: Simulate transaction without sending
- **`--no-relay`**: Disable gasless relay fallback
- **`--network <network>`**: Target network (default: mainnet)

• Confidence: 88% confidence
• Finding: The documented use of '--yes' enables unattended transaction execution without an interactive confirmation step. In the context of a self-custodial wallet skill that can send tokens, approve spenders, and sign data, this materially increases the risk of accidental or prompt-induced fund transfers because the final human verification barrier is removed.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill claims there are no network calls except public blockchain RPCs, but it also documents an x402 feature that performs arbitrary HTTP requests to user-supplied URLs. That mismatch can mislead operators about the trust boundary and cause them to expose wallet session tokens or authorize payments in workflows they believed were limited to blockchain RPC interactions.

Static analysis

No suspicious patterns detected.