ClawHub
Back to skill

Security audit

sequence-cli

Security checks across malware telemetry and agentic risk

Overview

This skill is legitimate wallet-management documentation, but it gives an agent direct private-key and token-transfer authority without enough safety guardrails.

Install only if you intend to let an agent manage a Sequence wallet or project. Use test wallets and minimal funds first, avoid sharing private keys in chat or command lines where possible, protect the passphrase and ~/.sequence-builder/config.json, and require human confirmation before any transfer.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly instructs use of raw private keys on the command line and local storage of an encrypted private key in ~/.sequence-builder/config.json, but does not warn that CLI arguments can leak via shell history, process listings, logs, or agent telemetry. In an AI-agent context, this is especially dangerous because secrets may be captured in transcripts or persisted automatically, enabling wallet compromise and theft of funds.

Session Persistence

Medium
Category
Rogue Agent
Content
# Sequence Builder CLI

CLI for Sequence Builder — designed for AI agents and automation. Create wallets, authenticate, manage projects, query blockchain data, and send ERC20 transfers from the command line.

All commands support `--json` for machine-readable output. Always use `--json` when parsing results programmatically.
Confidence
76% confidence
Finding
Create wallets, authenticate, manage projects, query blockchain data, and send ERC20 transfers from the command line. All commands support `--json` for machine-readable output. Always use `--json` wh

Session Persistence

Medium
Category
Rogue Agent
Content
npx @0xsequence/builder-cli create-wallet --json
# Save the output — privateKey and address
npx @0xsequence/builder-cli login --json
npx @0xsequence/builder-cli projects create "My App" --json
# Note the accessKey from the output
npx @0xsequence/builder-cli wallet-info -a <access-key> --json
# Fund the sequenceWalletAddress via the fundingUrl
Confidence
84% confidence
Finding
create "My App" --json # Note the accessKey from the output npx @0xsequence/builder-cli wallet-info -a <access-key> --json # Fund the sequenceWalletAddress via the fundingUrl ``` ### Check balance th

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.