circle-wallet

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:26 AM UTC
• Version: 1.0.17

Overview

This is a coherent Circle USDC wallet skill, but it deserves review because it can move real funds while providing limited confirmation, secret-storage, and reset-safety safeguards.

Install only if you are comfortable giving this skill Circle wallet credentials and possible production transfer authority. Use sandbox credentials first, keep API keys and entity secrets off shared machines and logs, verify file permissions under ~/.openclaw/circle-wallet/, back up wallet metadata before reconfiguring, and require a separate human confirmation for every send with the exact recipient, amount, network, and funding wallet.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The function enforces Ethereum-address formatting for every transfer, but the actual transfer chain is derived from defaultChain and may be non-Ethereum. This creates validation/behavior mismatch: valid destination formats for other chains may be rejected, or developers may incorrectly assume the check guarantees destination suitability for the configured blockchain, increasing the risk of failed or misdirected transfers.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation shows direct fund-transfer commands and even an agent example that sends USDC without mentioning confirmation, recipient verification, or the irreversible nature of blockchain transfers. In an agent skill context, this increases the chance of accidental or socially engineered transfers because users may assume the agent can safely execute payment requests without extra review.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs users to provide API keys and entity secrets and states where credentials are stored, but it does not warn about the sensitivity of these secrets or safe handling practices. In a wallet-management skill, compromised credentials could enable unauthorized wallet operations, access to balances, and potentially real asset transfers depending on environment and permissions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup flow persists the Circle API key and entity secret to local disk under the user's home directory, but the CLI only says that configuration was saved and does not clearly warn that highly sensitive credentials will remain stored locally. In an agent/CLI context, users may run this on shared hosts, CI runners, or multi-user systems and unintentionally expose wallet-management secrets through filesystem access, backups, or endpoint compromise.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The manual configure command stores existing credentials locally without an explicit notice that the API key and entity secret are being persisted on disk. Because these secrets control wallet operations, silent persistence increases the chance of accidental exposure on developer machines, containers, or shared automation environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup command unconditionally deletes existing local wallet metadata files when new credentials are registered, without warning or confirmation. This can cause destructive loss of local state, break wallet selection/default mappings, and create operational confusion that may lead users to send funds from or to the wrong wallet after reconfiguration.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The configure flow also deletes existing wallet metadata files without a user-facing warning or opt-in. In a wallet-management tool, silent destructive actions are risky because they can erase local references to important wallets and defaults, increasing the chance of user error and service disruption.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "eltontay",
  "license": "MIT",
  "dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",
    "commander": "^12.1.0",
    "dotenv": "^16.4.0"
  },

• Confidence: 93% confidence
• Finding: "@circle-fin/developer-controlled-wallets": "^10.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",
    "commander": "^12.1.0",
    "dotenv": "^16.4.0"
  },
  "devDependencies": {

• Confidence: 86% confidence
• Finding: "commander": "^12.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@circle-fin/developer-controlled-wallets": "^10.1.0",
    "commander": "^12.1.0",
    "dotenv": "^16.4.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",

• Confidence: 87% confidence
• Finding: "dotenv": "^16.4.0"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.