T08 · Insecure Dependencies
Error
- Location
SKILL.md:13- Finding
Unpinned Global npm Dependency Receives Wallet-Level Trust
- Content
View full analysis
- Remediation
View remediation
Security audit
Emblem Ai Agent Wallet
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent crypto wallet skill, but it gives an external global npm CLI wallet-level authority and documents risky credential/session handling patterns users should review carefully.
Review this carefully before installing. Use a low-value or test wallet first, prefer browser authentication, avoid putting the wallet password in command-line arguments, shell history, scripts, or environment variables, verify or pin the npm package before installing, protect `~/.emblemai/`, and review every transaction detail before approving any wallet-modifying action.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:161- Finding
Wallet Master Password Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (20)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The top-level description promotes trading, swapping, and blockchain wallet interaction without prominently warning about irreversible transactions, asset loss, phishing, or market risk. Because this is a wallet-management skill, understated risk messaging increases the chance that users treat it like a normal informational tool rather than a financial control surface.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill metadata explicitly identifies sensitive config paths containing encrypted credentials, keys, session tokens, and history. In an agent ecosystem, exposing these locations makes it easier for other tools, prompts, or compromised components to target wallet secrets and session artifacts for exfiltration or misuse.
- Content
md description: Connect to EmblemVault and manage crypto wallets via Emblem AI - Agent Hustle. Supports Solana, Ethereum, Base, BSC, Polygon, Hedera, and Bitcoin. Use when the user wants to trade crypto, check balances, swap tokens, or interact with blockchain wallets. homepage: https://emblemvault.dev user-invocable: true metadata: {"openclaw":{"emoji":"🛡️","version":"3.0.8","homepage":"https://emblemvault.dev","primaryEnv":"EMBLEM_PASSWORD","requires":{"bins":["node","npm","emblemai"],"env":["EMBLEM_PASSWORD"]},"config_paths":["~/.emblemai/.env","~/.emblemai/.env.keys","~/.emblemai/session.json","~/.emblemai/history/"],"install":[{"id":"npm","kind":"npm","package":"@emblemvault/agentwallet","bins":["emblemai"],"label":"Install Agent Wallet CLI"}]}} --- # Emblem Agent Wallet
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
emblemai -p "$PASSWORD" # Password auth
text ### Reset Conversation ```bash emblemai --reset
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Command | Description | |---------|-------------| | `/reset` | Clear conversation history and start fresh | | `/clear` | Alias for `/reset` | | `/history on\|off` | Toggle history retention between messages | | `/history` | Show history status and recent messages |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md | Command | Description | |---------|-------------| | `/reset` | Clear conversation history and start fresh | | `/clear` | Alias for `/reset` | | `/history on\|off` | Toggle history retention between messages | | `/history` | Show history status and recent messages |
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 75% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md | `--agent` | `-a` | Run in agent mode (single-shot, password auth only) | | `--restore-auth <path>` | | Restore credentials from backup file and exit | | `--reset` | | Clear conversation history and exit | | `--debug` | | Start with debug mode enabled | | `--stream` | | Start with streaming enabled (default: on) | | `--log` | | Enable stream logging | | `--log-file <path>` | | Override log file path (default: `~/.emblemai-stream.log`) |
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
export EMBLEM_PASSWORD="your-password-16-chars-min" emblemai --agent -m "Show my portfolio"
Reset conversation history
emblemai --reset
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 84% confidence
- Finding
The documentation confirms that session.json contains an access token and refresh token sufficient for wallet access until expiry. In a wallet-management context, that is highly sensitive information because any component instructed to inspect local files could reuse the session to access balances, addresses, or potentially authorize operations.
- Content
md |------|-----------------|-------------------| | `.env` | Your EMBLEM_PASSWORD | Encrypted with AES-256-GCM via [dotenvx](https://dotenvx.com/). The password is never stored in plaintext. | | `.env.keys` | The AES decryption key for `.env` | File permissions `chmod 600` (owner-only). This key never leaves your machine and is never transmitted over the network. | | `session.json` | JWT access token + refresh token | File permissions `chmod 600`. The JWT expires after 15 minutes and is automatically refreshed. The refresh token is valid for 7 days. Logging out deletes this file. | | `history/*.json` | Conversation history | File permissions `chmod 600`. Contains your chat messages with the AI. No credentials are stored in history. | The `~/.emblemai/` directory itself is created with `chmod 700` (owner-only access).
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation phrases are broad enough that ordinary crypto questions like checking balances or connecting a wallet could automatically trigger this high-risk wallet skill. In an agentic environment, overbroad routing can cause unintentional credential use, wallet access, or transaction-capable tooling to be activated for requests that did not clearly consent to wallet operations.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## File Locations All persistent data is stored under `~/.emblemai/` (created on first run with `chmod 700`). | File | Purpose | Sensitive | Permissions | |------|---------|-----------|-------------|
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## File Locations All persistent data is stored under `~/.emblemai/` (created on first run with `chmod 700`). | File | Purpose | Sensitive | Permissions | |------|---------|-----------|-------------|
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The skill documents persistent local session storage with a refresh token valid for 7 days and not encrypted at rest, only permission-restricted. In a wallet context, persistent bearer credentials materially increase post-compromise dwell time because theft of the session file can extend access beyond a short-lived interactive session.
- Content
md ### Encryption Details Credentials are encrypted at rest using [dotenvx](https://dotenvx.com/), which uses **AES-256-GCM** symmetric encryption. The encryption key is stored in `~/.emblemai/.env.keys` and the encrypted payload in `~/.emblemai/.env`. Both files are created with `chmod 600` (owner read/write only). The decryption key never leaves the local machine. Session tokens (`session.json`) contain a short-lived JWT (refreshed automatically) and a refresh token valid for 7 days. Sessions are not encrypted on disk but are restricted to `chmod 600`. Logging out via `/auth` > Logout deletes the session file.
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill makes strong safety claims that wallet-modifying actions always require explicit confirmation, but elsewhere it advertises one-shot agent-mode commands for sends and swaps. This mismatch is dangerous because a host agent or user may trust the documentation and invoke transfer/trade operations assuming a confirmation gate exists when the CLI or downstream service could execute immediately.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md The agent operates in **safe mode by default**. This means: - **All wallet-modifying actions require your explicit confirmation** before execution -- including swaps, sends, transfers, order placement, signing, and DeFi operations - **Read-only operations execute immediately** without confirmation -- balance checks, address lookups, market data, portfolio views - The agent will present the full details of any transaction (amounts, addresses, fees) and wait for your approval before submitting - There is no "auto-execute" mode -- every transaction requires a human in the loop
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - **All wallet-modifying actions require your explicit confirmation** before execution -- including swaps, sends, transfers, order placement, signing, and DeFi operations - **Read-only operations execute immediately** without confirmation -- balance checks, address lookups, market data, portfolio views - The agent will present the full details of any transaction (amounts, addresses, fees) and wait for your approval before submitting - There is no "auto-execute" mode -- every transaction requires a human in the loop ### Password Hygiene
Static analysis
No suspicious patterns detected.