HashPack Wallet
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: hashpack-wallet Version: 1.0.0 The skill bundle describes the integration of the HashPack wallet for Hedera blockchain interactions, including connecting, signing transactions, and querying balances. The `SKILL.md` file provides descriptive information and TypeScript code examples for these operations. There is no evidence of prompt injection attempts against the AI agent, data exfiltration, malicious execution, persistence mechanisms, or obfuscation. While the ability to sign transactions is a powerful and sensitive capability, it aligns directly with the stated purpose of a wallet integration skill, and the skill bundle itself does not contain any instructions or code indicating malicious intent or unauthorized actions.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A web app built from these instructions could request wallet signatures for transactions that transfer assets or perform other blockchain actions.
The skill documents transaction-signing flows that can move funds. This is expected for a HashPack wallet integration, but it is high-impact if used without explicit user review.
Sign and submit transaction ... .addHbarTransfer(from, -10) ... .addHbarTransfer(to, 10); await hashpack.signTransaction(tx);
Use explicit wallet prompts, show network, recipient, amount, and fees before signing, and test on testnet before enabling mainnet actions.
The integrated app may learn the connected Hedera account ID and request wallet permissions.
The skill connects to a user wallet and obtains an account ID. This is normal for wallet login, but it delegates account identity to the web application.
const result = await hashpack.connect(); ... const accountId = result.accountId;
Only connect trusted apps, disclose what account data is read, and never ask users for seed phrases or private keys.