Emblem Ai Agent Wallet

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:51 AM UTC
• Version: 3.0.9

Overview

This is a transparent crypto wallet skill, but it deserves Review because it gives agents high-impact wallet abilities and the noninteractive transaction-approval boundary is not fully demonstrated.

Install only if you trust EmblemVault and the npm package. Use a dedicated wallet with limited funds, protect EMBLEM_PASSWORD and ~/.emblemai, prefer browser auth for interactive use, and do not allow unattended agent-mode transfers, swaps, signing, or DeFi actions unless you independently verify that every transaction requires explicit human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The skill advertises broad invocation phrases like 'Connect to EmblemVault' and 'Check my crypto portfolio' for a wallet-management capability. Because this skill can access sensitive wallet data and initiate high-risk financial workflows, overly generic triggers increase the chance of accidental activation in unrelated conversations, which can expose balances or lead users into transactional flows unintentionally.

Credential Access

High

• Category: Privilege Escalation

Content

description: Connect to EmblemVault and manage crypto wallets via Emblem AI - Agent Hustle. Supports Solana, Ethereum, Base, BSC, Polygon, Hedera, and Bitcoin. Use when the user wants to trade crypto, check balances, swap tokens, or interact with blockchain wallets.
homepage: https://emblemvault.dev
user-invocable: true
metadata: {"openclaw":{"emoji":"🛡️","version":"3.0.8","homepage":"https://emblemvault.dev","primaryEnv":"EMBLEM_PASSWORD","requires":{"bins":["node","npm","emblemai"],"env":["EMBLEM_PASSWORD"]},"config_paths":["~/.emblemai/.env","~/.emblemai/.env.keys","~/.emblemai/session.json","~/.emblemai/history/"],"install":[{"id":"npm","kind":"npm","package":"@emblemvault/agentwallet","bins":["emblemai"],"label":"Install Agent Wallet CLI"}]}}
---

# Emblem Agent Wallet

• Confidence: 91% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

|------|-----------------|-------------------|
| `.env` | Your EMBLEM_PASSWORD | Encrypted with AES-256-GCM via [dotenvx](https://dotenvx.com/). The password is never stored in plaintext. |
| `.env.keys` | The AES decryption key for `.env` | File permissions `chmod 600` (owner-only). This key never leaves your machine and is never transmitted over the network. |
| `session.json` | JWT access token + refresh token | File permissions `chmod 600`. The JWT expires after 15 minutes and is automatically refreshed. The refresh token is valid for 7 days. Logging out deletes this file. |
| `history/*.json` | Conversation history | File permissions `chmod 600`. Contains your chat messages with the AI. No credentials are stored in history. |

The `~/.emblemai/` directory itself is created with `chmod 700` (owner-only access).

• Confidence: 88% confidence
• Finding: access token

Session Persistence

Medium

• Category: Rogue Agent

Content

### Encryption Details

Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine.

Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.

• Confidence: 85% confidence
• Finding: write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.