Security audit

Golden Claw

Security checks for vulnerabilities and agentic risk

Overview

This crypto-wallet skill is not clearly malicious, but it needs review because it can move funds and auto-installs mutable dependencies at runtime.

Install only if you trust the publisher and are comfortable with a skill that creates and stores an encrypted crypto wallet, signs GCLAW and SOL transactions, contacts Solana RPC and goldenclaw.org, and can run npm install. Avoid using meaningful funds until dependencies are pinned and reviewed, never pass a real seed phrase through shell/chat command arguments, verify the donation address before sending SOL, and set conservative spending limits and an isolated OPENCLAW_DATA_DIR.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: package.json:27
Finding: Mutable Dependencies Without an Integrity Lockfile
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.
Content: No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: goldenclaw description: Manage GoldenClaw (GCLAW) on Solana. Create wallet, claim from faucet, check balance, send tokens, view history. For OpenClaw AI agents. license: MIT metadata: version: 1.1.0 commands: gclaw author: AgentCrypto --- # GoldenClaw (GCLAW) Skill Solana SPL token skill for [OpenClaw](https://openclaw.ai): wallet, faucet claims, and agent-to-agent transfers in GCLAW. ## Installation 1. Extract the skill to your `skills/` folder 2. Run `npm run build` in the skill directory (dependencies are installed automatically when the skill runs if missing) ## Commands - `gclaw setup` �

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill executes npm install automatically at runtime via execSync, which runs arbitrary package lifecycle scripts and pulls code from the network without user approval. In a wallet-managing skill, this materially expands the trust boundary: a compromised dependency, registry, or install script could lead to code execution and theft of wallet data or transaction signing secrets.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code contains a hardcoded donation path that sends SOL to a project-controlled address, which is not justified by the skill description. In an AI-agent context, embedding treasury-directed transfers creates a high-risk abuse pattern because a user may invoke wallet functionality without realizing the skill can also exfiltrate native funds to a fixed destination.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README instructs users to run wallet recovery with a seed phrase as a command-line argument but does not warn that shell arguments can be exposed through shell history, process listings, logs, or agent transcripts. In the context of a Solana wallet skill, exposure of a recovery phrase can directly lead to full wallet compromise and irreversible asset theft.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description limits the skill to managing GCLAW on Solana through wallet creation, faucet claims, balance checks, token sends, and history viewing. The README adds a separate gclaw donate <SOL> command that transfers SOL to a treasury wallet, which is a materially different financial operation not described in the manifest.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The manifest does not declare any explicit tool scope or permissions even though the skill reportedly uses environment access and outbound network capabilities. For a wallet and token-transfer skill, undeclared capabilities reduce transparency and prevent hosts or users from applying least-privilege controls before enabling potentially sensitive actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes send and donate commands for digital assets without warning that transfers are irreversible or that mistakes in amount/address can permanently lose funds. In a wallet skill, omission of transaction-risk warnings increases the chance of social engineering, operator error, and accidental loss, especially when used by autonomous or semi-autonomous agents.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation advertises a treasury donation command that is not disclosed in the manifest description. In a crypto-wallet context, undocumented payment flows materially increase risk because users or orchestrators may enable the skill expecting passive wallet management, not the ability to send native assets to a treasury address.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code path for reading the treasury balance uses getOrCreateAssociatedTokenAccount with a generated signer, which can attempt to create an associated token account on-chain rather than performing a purely read-only lookup. In an agent skill, a balance-check operation unexpectedly causing state changes, RPC side effects, or fee-incurring account creation is dangerous because users and calling systems may invoke it assuming it is safe and non-mutating.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest says the skill can create a wallet, claim from faucet, check balance, send tokens, and view history. The code and command documentation additionally support recovering a wallet from a seed phrase and deleting a wallet, which are materially different wallet-lifecycle operations not reflected in the manifest description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The stated purpose is to manage GCLAW on Solana with wallet creation, faucet claiming, balance checking, token sending, and history viewing. The code also includes a donate command that sends SOL to a fixed treasury address, which is a separate funds-transfer capability not described in the manifest.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Running npm install automatically without warning or confirmation causes shell execution and network retrieval in a sensitive wallet context. Even if intended for convenience, it can surprise operators, bypass normal supply-chain controls, and allow dependency scripts to execute with the agent's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The claim flow sends the user's wallet address to a remote faucet service without an explicit privacy notice or consent step. While an address is not a secret like a seed phrase, it is still identifying blockchain metadata and linking it to service usage can enable tracking, profiling, or correlation of activity.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This file implements on-chain distribution and claim-verification features that are not disclosed in the skill’s stated scope of wallet, faucet, balance, transfer, and history operations. Hidden or undeclared blockchain actions expand the trust boundary for the agent and can lead users or orchestrators to invoke token-distribution logic they did not intend to authorize or review.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The send function allows callers to bypass an extra confirmation gate for larger transfers by setting skipConfirmation=true. In an agentic environment, this weakens human-in-the-loop protections and can let another component or prompt-driven workflow approve higher-risk transfers without fresh user confirmation.
Content: Scanner excerpt · dist/transactions.js (reported line 35)May include surrounding context.
js
* @param recipientAddress - Destination wallet address * @param amount - Amount of CLAW to send * @param password - Wallet password for signing * @param skipConfirmation - Skip confirmation for amounts above threshold */ async function sendTokens(recipientAddress, amount, password, skipConfirmation = false) { // Validate configuration

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module adds a SOL donation transfer capability that is outside the stated skill purpose of managing GCLAW tokens and wallets. In an agent setting, scope expansion to direct native-token transfers increases the chance of unexpected value movement and user confusion, especially because SOL is the fee-bearing native asset rather than the advertised token.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The deleteWallet() function irreversibly overwrites and deletes the wallet file and also removes the spending tracker, but there is no confirmation prompt, user-facing log, or explicit warning at the point of deletion. Because this operation destroys user data and may prevent wallet access unless the mnemonic was backed up elsewhere, it is a safety-critical action that should be disclosed more clearly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The package scripts invoke npx ts-node without an exact package version, which can cause execution of a different ts-node release than the one expected if local resolution fails or the environment permits network fetching. In an agent or CI context, that creates a supply-chain risk because script execution may pull and run unreviewed code at runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The check-claim script uses npx ts-node without pinning, so execution semantics depend on environment resolution and may fetch or run an unexpected package version. Because these scripts are capable of running arbitrary TypeScript, any compromised or substituted toolchain package could execute attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The initialize script also relies on unpinned npx ts-node, introducing a runtime dependency-resolution risk. In a wallet/token-management skill, initialization scripts are especially sensitive because compromise could affect wallet setup, addresses, or secrets handled during provisioning.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.