ClawHub
Back to skill

Security audit

Vincent - Agent Wallet

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed wallet integration, but it gives an agent broad financial authority with fail-open policies and weak credential-handling guidance.

Review this skill carefully before installing. Only use it if you trust the hosted wallet service and are comfortable giving an agent wallet authority. Claim the wallet immediately, configure approval requirements, spending limits, and allowlists before funding it, store API keys in a real secret store rather than a project directory, and treat API keys or re-link tokens like wallet credentials. Be aware that the Polymarket balance call can deploy a Safe and approve collateral.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:40
Finding

Wallet Bearer Tokens Are Persisted Without Mandatory Storage Protections

Content
View full analysis
.json`. Otherwise, you can store it in your current working directory at `agentwallet/.json`. \`\`\` Authorization: Bearer \`\`\` ``` The storage and lookup requirements are repeated later: ```markdown - Always store the API key from wallet creation. If you're an openclaw instance, store it in `~/.openclaw/credentials/agentwallet/.json`. Otherwise, you can store it in your current working directory at `agentwallet/.json`. - Always search for the API keys in the credentials folder before using the API. If you're an openclaw instance, search for the API key in `~/.openclaw/credentials/agentwallet/.json`. Otherwise, you can search for the API key in your current working directory at `agentwallet/.json`. ``` ### Technical Analysis The Skill requires persistent storage of a bearer token that authorizes financially sensitive wallet operations. However, it does not require encryption, an operating-system secret manager, restrictive directory and file permissions, repository exclusions, or credential redaction. The fallback location under the current working directory is particularly unsafe. Such files may be committed to source control, included in build artifacts or backups, exposed to other workspace users, or read by unrelated tools operating in the same project directory. Searching the dedicated credential directory is functionally related to the Skill and does not, by itself, exceed the minimum privilege required to retrieve this Skill's own token. The risk arises fr ...[truncated 1492 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:160
Finding

New Wallets Permit Financial Operations Before Restrictive Policies Are Configured

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:326
Finding

Balance Retrieval Unexpectedly Deploys a Wallet and Grants Token Approval

Content
View full analysis
" \`\`\` Returns: - `walletAddress` -- the Safe address (deployed on first call if needed) - `collateral.balance` -- USDC.e balance available for trading - `collateral.allowance` -- approved amount for Polymarket contracts **Note:** The first balance call triggers Safe deployment and collateral approval (gasless via relayer). This may take 30-60 seconds. ``` ### Technical Analysis The documented `GET /balance` operation is not read-only. Its first invocation deploys a Safe and performs a collateral approval. This violates the normal safety and idempotence expectations associated with HTTP GET requests and makes a routine inspection operation produce on-chain state changes. The Skill does not identify the exact approval spender, approval amount, expiration behavior, or revocation procedure. Consequently, an agent or user requesting only balance information may unintentionally establish token-spending authority for external contracts. Although the approval is described as being for Polymarket contracts and is related to the wallet's intended trading functionality, coupling it to balance retrieval is not the minimum authority necessary to obtain a balance. ### Attack Path 1. An agent creates a Polymarket wallet. 2. The agent calls the documented GET balance endpoint to determine the wallet address or inspect funds. 3. The backend interprets the first balance request as authorization to deploy the Safe and approve collateral. 4. An on-chain allowance is established for the configured Polymarket contract or contracts without a separate transaction-specific confirmation. 5. If the approved contract, spender configuratio ...[truncated 683 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The statement that all actions are allowed by default if no policies are set creates a dangerous default-permit model for a wallet-controlling agent. In context, this is especially risky because the same skill supports arbitrary transactions and raw signing, so a newly created or unclaimed wallet may be fully usable for sensitive operations before any user protections are configured.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill enables high-risk financial actions including transfers, swaps, arbitrary contract calls, raw signing, and betting, but the introductory guidance emphasizes convenience and safety of key handling more than the fact that real assets can be irreversibly spent. In an agent setting, that omission materially increases the chance of accidental fund movement or user misunderstanding, especially because the skill normalizes autonomous transaction execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Create a new smart account wallet for your agent. This generates a private key server-side (you never see it), creates a ZeroDev smart account, and returns an API key for the agent plus a claim URL for the wallet owner.

bash
curl -X POST "https://heyvincent.ai/api/secrets" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "EVM_WALLET",

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The re-link flow instructs the agent to accept a one-time token from the user and exchange it for a new API key on an unauthenticated endpoint, making possession of the token equivalent to wallet access. In an agent environment, such tokens are highly susceptible to prompt leakage, logging, transcript retention, or social engineering, so this workflow creates a meaningful credential-capture and account-takeover risk.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

  1. The agent calls the re-link endpoint to exchange the token for a new API key
bash
curl -X POST "https://heyvincent.ai/api/secrets/relink" \
  -H "Content-Type: application/json" \
  -d '{
    "relinkToken": "<TOKEN_FROM_USER>",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

Create a Polymarket Wallet

bash
curl -X POST "https://heyvincent.ai/api/secrets" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "POLYMARKET_WALLET",

Static analysis

No suspicious patterns detected.