Golden Claw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:35 PM UTC
• Version: 1.0.0

Overview

This crypto-wallet skill is not clearly malicious, but it needs review because it can move funds and auto-installs mutable dependencies at runtime.

Install only if you trust the publisher and are comfortable with a skill that creates and stores an encrypted crypto wallet, signs GCLAW and SOL transactions, contacts Solana RPC and goldenclaw.org, and can run npm install. Avoid using meaningful funds until dependencies are pinned and reviewed, never pass a real seed phrase through shell/chat command arguments, verify the donation address before sending SOL, and set conservative spending limits and an isolated OPENCLAW_DATA_DIR.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:27
• Finding: Mutable Dependencies Without an Integrity Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `package.json:27-39` **Vulnerability Type**: Third-party dependency and software supply-chain risk **Risk Level**: Medium ### Vulnerable Code ```json "dependencies": { "@solana/spl-token": "^0.4.0", "@solana/web3.js": "^1.98.4", "argon2": "^0.41.0", "bip39": "^3.1.0", "bs58": "^6.0.0", "ed25519-hd-key": "^1.3.0" }, "devDependencies": { "@types/node": "^20.11.0", "ts-node": "^10.9.2", "typescript": "^5.3.0" } ``` No package lockfile is present in the supplied project. ### Technical Analysis Every declared dependency uses a caret version range. These ranges permit npm to install later compatible releases that were not necessarily present when this artifact was created or audited. The absence of `package-lock.json`, `npm-shrinkwrap.json`, or another integrity-bearing lockfile also leaves transitive dependency versions and integrity hashes unspecified. The installation instructions direct users to run `npm install`, and the skill documentation states that dependencies may be installed automatically. An installation can therefore resolve code that differs from the code reviewed during the audit. This is especially sensitive for a cryptocurrency wallet package because its dependencies are intended to participate in cryptographic key derivation, wallet encryption, Solana RPC communication, and token transactions. The native `argon2` package also increases exposure to package installation and native build behavior. This finding does not establish that any currently named dependency is malicious. The vulnerability is the inability to reproduce and integrity-check the dependency graph, which creates a supply-chain attack opportunity if a package publisher, maintainer account, registry response, or transitive component is compromised. ### Attack Path 1. A user follows the documented installation process and runs `npm install`, or the surrounding skill framework installs missing dependencies ...[truncated 1522 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate and commit an integrity-bearing `package-lock.json` using a trusted npm version. 2. Use `npm ci` in installation, build, test, and deployment workflows so the dependency graph matches the reviewed lockfile. 3. Pin security-sensitive direct dependencies to explicitly reviewed versions rather than permitting unreviewed updates through caret ranges. 4. Review and continuously scan both direct and transitive dependencies with tools such as `npm audit` and a maintained software composition analysis service. 5. Disable package lifecycle scripts where they are unnecessary, for example by using `npm ci --ignore-scripts`, and explicitly allow only packages whose installation scripts are required and reviewed. 6. Build in a restricted environment without wallet secrets, production credentials, or unnecessary filesystem permissions. 7. Produce reproducible release artifacts and publish provenance, checksums, and a software bill of materials. 8. Include the advertised source and compiled files in the reviewable package so dependency usage, wallet-secret handling, and transaction behavior can be audited before release. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: If the implementation truly lacks the advertised faucet, balance, transfer, and history features while adding undeclared encrypted wallet storage and spending-limit tracking, the manifest is materially misleading. In a financial skill, undocumented secret storage and control logic can alter trust assumptions and lead users to expose credentials or funds under false expectations.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: goldenclaw
description: Manage GoldenClaw (GCLAW) on Solana. Create wallet, claim from faucet, check balance, send tokens, view history. For OpenClaw AI agents.
license: MIT
metadata:
  version: 1.1.0
  commands: gclaw
  author: AgentCrypto
---

# GoldenClaw (GCLAW) Skill

Solana SPL token skill for [OpenClaw](https://openclaw.ai): wallet, faucet claims, and agent-to-agent transfers in GCLAW.

## Installation

1. Extract the skill to your `skills/` folder
2. Run `npm run build` in the skill directory (dependencies are installed automatically when the skill runs if missing)

## Commands

- `gclaw setup` �

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill executes `npm install` automatically at runtime via `execSync`, which runs arbitrary package lifecycle scripts and pulls code from the network without user approval. In a wallet-managing skill, this materially expands the trust boundary: a compromised dependency, registry, or install script could lead to code execution and theft of wallet data or transaction signing secrets.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code contains a hardcoded donation path that sends SOL to a project-controlled address, which is not justified by the skill description. In an AI-agent context, embedding treasury-directed transfers creates a high-risk abuse pattern because a user may invoke wallet functionality without realizing the skill can also exfiltrate native funds to a fixed destination.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README instructs users to run wallet recovery with a seed phrase as a command-line argument but does not warn that shell arguments can be exposed through shell history, process listings, logs, or agent transcripts. In the context of a Solana wallet skill, exposure of a recovery phrase can directly lead to full wallet compromise and irreversible asset theft.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description limits the skill to managing GCLAW on Solana through wallet creation, faucet claims, balance checks, token sends, and history viewing. The README adds a separate `gclaw donate <SOL>` command that transfers SOL to a treasury wallet, which is a materially different financial operation not described in the manifest.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The manifest does not declare any explicit tool scope or permissions even though the skill reportedly uses environment access and outbound network capabilities. For a wallet and token-transfer skill, undeclared capabilities reduce transparency and prevent hosts or users from applying least-privilege controls before enabling potentially sensitive actions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill exposes send and donate commands for digital assets without warning that transfers are irreversible or that mistakes in amount/address can permanently lose funds. In a wallet skill, omission of transaction-risk warnings increases the chance of social engineering, operator error, and accidental loss, especially when used by autonomous or semi-autonomous agents.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The documentation advertises a treasury donation command that is not disclosed in the manifest description. In a crypto-wallet context, undocumented payment flows materially increase risk because users or orchestrators may enable the skill expecting passive wallet management, not the ability to send native assets to a treasury address.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code path for reading the treasury balance uses getOrCreateAssociatedTokenAccount with a generated signer, which can attempt to create an associated token account on-chain rather than performing a purely read-only lookup. In an agent skill, a balance-check operation unexpectedly causing state changes, RPC side effects, or fee-incurring account creation is dangerous because users and calling systems may invoke it assuming it is safe and non-mutating.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest says the skill can create a wallet, claim from faucet, check balance, send tokens, and view history. The code and command documentation additionally support recovering a wallet from a seed phrase and deleting a wallet, which are materially different wallet-lifecycle operations not reflected in the manifest description.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The stated purpose is to manage GCLAW on Solana with wallet creation, faucet claiming, balance checking, token sending, and history viewing. The code also includes a `donate` command that sends SOL to a fixed treasury address, which is a separate funds-transfer capability not described in the manifest.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Running `npm install` automatically without warning or confirmation causes shell execution and network retrieval in a sensitive wallet context. Even if intended for convenience, it can surprise operators, bypass normal supply-chain controls, and allow dependency scripts to execute with the agent's privileges.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The claim flow sends the user's wallet address to a remote faucet service without an explicit privacy notice or consent step. While an address is not a secret like a seed phrase, it is still identifying blockchain metadata and linking it to service usage can enable tracking, profiling, or correlation of activity.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This file implements on-chain distribution and claim-verification features that are not disclosed in the skill’s stated scope of wallet, faucet, balance, transfer, and history operations. Hidden or undeclared blockchain actions expand the trust boundary for the agent and can lead users or orchestrators to invoke token-distribution logic they did not intend to authorize or review.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

* @param recipientAddress - Destination wallet address
 * @param amount - Amount of CLAW to send
 * @param password - Wallet password for signing
 * @param skipConfirmation - Skip confirmation for amounts above threshold
 */
async function sendTokens(recipientAddress, amount, password, skipConfirmation = false) {
    // Validate configuration

• Confidence: 85% confidence
• Finding: The send function allows callers to bypass an extra confirmation gate for larger transfers by setting skipConfirmation=true. In an agentic environment, this weakens human-in-the-loop protections and can let another component or prompt-driven workflow approve higher-risk transfers without fresh user confirmation.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The module adds a SOL donation transfer capability that is outside the stated skill purpose of managing GCLAW tokens and wallets. In an agent setting, scope expansion to direct native-token transfers increases the chance of unexpected value movement and user confusion, especially because SOL is the fee-bearing native asset rather than the advertised token.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The deleteWallet() function irreversibly overwrites and deletes the wallet file and also removes the spending tracker, but there is no confirmation prompt, user-facing log, or explicit warning at the point of deletion. Because this operation destroys user data and may prevent wallet access unless the mnemonic was backed up elsewhere, it is a safety-critical action that should be disclosed more clearly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The package scripts invoke `npx ts-node` without an exact package version, which can cause execution of a different `ts-node` release than the one expected if local resolution fails or the environment permits network fetching. In an agent or CI context, that creates a supply-chain risk because script execution may pull and run unreviewed code at runtime.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The `check-claim` script uses `npx ts-node` without pinning, so execution semantics depend on environment resolution and may fetch or run an unexpected package version. Because these scripts are capable of running arbitrary TypeScript, any compromised or substituted toolchain package could execute attacker-controlled code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The `initialize` script also relies on unpinned `npx ts-node`, introducing a runtime dependency-resolution risk. In a wallet/token-management skill, initialization scripts are especially sensitive because compromise could affect wallet setup, addresses, or secrets handled during provisioning.

Static analysis

No suspicious patterns detected.