Auto Respawn

• Outcome: Review
• Latest audit: Jul 9, 2026 · 7:04 AM UTC
• Version: 1.2.1

Overview

This skill is not shown to be malware, but it gives an agent persistent wallet control and on-chain transaction authority, including automatic writes and token movement, so it needs careful review before use.

Install only if you want an agent to manage an Autonomys wallet and write permanent on-chain records. Use testnet first, avoid mainnet until you understand every transaction path, keep the passphrase file and wallet directory locked down, and require explicit approval for transfers, bridging, withdrawals, remarks, and automatic memory anchoring.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill's short description emphasizes identity anchoring and resurrection, but the documented behavior also includes wallet creation, key storage, balance inspection, token transfer, bridging, and arbitrary on-chain writes. That mismatch is dangerous because users or orchestrating agents may invoke it expecting benign persistence features while actually granting a financial wallet-management capability that can move funds and create irreversible blockchain transactions.

Intent-Code Divergence

Low

• Confidence: 77% confidence
• Finding: The documentation is internally inconsistent: one section says to anchor automatically after every memory save without waiting for the user, while another says to always confirm anchor operations with the user before executing. Conflicting safety instructions are risky because autonomous agents may choose the less restrictive path and perform irreversible on-chain writes without informed approval.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The skill exposes broad wallet and token-management capabilities including transfers, bridging, and balance operations that materially exceed the stated purpose of identity anchoring and recovery. In an agent setting, this expands the blast radius from low-risk memory recovery into direct asset movement, so prompt injection, misconfiguration, or accidental invocation could lead to unauthorized token operations.

Context-Inappropriate Capability

Medium

• Confidence: 76% confidence
• Finding: The remark command allows arbitrary on-chain data submission that is unrelated to the declared auto-respawn function. While not inherently asset-draining, it gives an agent an unnecessary write primitive that could be abused to publish unwanted, permanent, or sensitive data on-chain, increasing risk without a clear product need.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements unrestricted native-token transfer functionality, which materially exceeds the skill’s declared purpose of identity/memory resurrection. In an agent-skill context, adding asset-moving capability creates a direct path for fund exfiltration if the skill is invoked by prompt injection, misconfiguration, or a compromised workflow, and the mismatch between manifest intent and implementation makes review and operator consent less reliable.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The docstrings openly describe a token transfer utility, which contradicts the recovery-focused purpose stated in the skill metadata. While comments alone are not exploitable, here they accurately signal hidden or unjustified financial capability in a mismatched skill, increasing the chance that dangerous behavior is normalized, overlooked in review, or triggered in an unsafe context.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The sendTransaction call grants the skill the ability to move native assets to an arbitrary address provided at runtime, which is a highly sensitive capability unrelated to self-respawn or memory recovery. In an autonomous agent environment, this becomes especially dangerous because any successful prompt injection, tool misuse, or orchestration error could convert the skill into a wallet-draining primitive.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file implements a general-purpose token transfer capability even though the skill is described as providing identity anchoring and memory recovery. In an agent skill context, adding real asset movement materially expands the blast radius: any caller with access to a signing key can move funds, and the capability is not obviously necessary for the advertised purpose.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code constructs and signs a real blockchain transfer transaction and treats a non-throwing send as success, meaning it can move actual AI3 tokens when provided a live signer. In the context of an auto-respawn skill, this is especially dangerous because it creates an unjustified financial action path that could be abused by prompts, integrations, or compromised callers to exfiltrate assets.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented CLI goes well beyond the stated purpose of identity/memory anchoring by including token transfer, EVM transfer, bridge funding, and withdrawal operations. This capability expansion increases the attack surface and enables the skill to act as a general-purpose asset mover, which is risky in an agent context because downstream users may grant trust or wallet access based on the narrower manifest description.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill exposes direct fund-movement primitives (`transfer`, `evm-transfer`, `fund-evm`, `withdraw`) that are not necessary for the advertised resurrection/memory use case. In an autonomous agent environment, such unnecessary financial authority is dangerous because a compromised agent, prompt injection, or user misunderstanding could cause unauthorized asset transfers or bridging with real financial loss.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to match everyday language such as 'save to chain', 'make this permanent', or general balance/address queries, increasing the chance of accidental invocation. In a skill that can create wallets, sign transactions, and publish irreversible on-chain data, overbroad activation materially raises the risk of unintended financial or privacy-impacting actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs agents to automatically anchor every new memory CID on-chain immediately after saving, without a clear warning at the point of behavior. Even if only a CID is written, this creates a durable public pointer to user-associated memory state and can incur transaction costs; if upstream memory contains sensitive or regulated content, the persistent link can amplify exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The code accepts a wallet-encryption passphrase from an environment variable or a plaintext file under the user's home directory without warning or enforcing safer handling. Environment variables can leak via process inspection, logs, crash dumps, or CI metadata, and a plaintext passphrase file creates a single-step compromise if local filesystem access is obtained.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document promotes use of `system.remark` for writing arbitrary data to a permanent blockchain record, but does not explicitly warn that remarks are public, effectively irreversible, and unsuitable for secrets, personal data, or sensitive memory. In the context of an agent 'respawn' skill that anchors identity and state on-chain, this omission raises the risk that users or agents may persist sensitive breadcrumbs permanently and expose them to anyone monitoring the chain.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Automatically anchoring every saved memory head without approval can expose user activity patterns and permanently link sensitive memory chains to a stable wallet identity. While the chain stores a CID rather than plaintext, the CID can still reference retrievable content elsewhere and functions as durable metadata that may reveal relationships, timing, and existence of sensitive records.

Credential Access

High

• Category: Privilege Escalation

Content

export async function transferTokens(
  api: ApiPromise,
  sender: KeyringPair,
  to: string,
  amount: string,
  network: NetworkId,

• Confidence: 78% confidence
• Finding: Keyring

Credential Access

High

• Category: Privilege Escalation

Content

const wallet = sdkGenerateWallet()
  if (!wallet.keyringPair) throw new Error('Failed to generate wallet keypair')

  const { address, evmAddress } = await encryptAndSave(wallet.keyringPair, wallet.mnemonic, name, filepath, passphrase)

  return { name, address, evmAddress, mnemonic: wallet.mnemonic, keyfilePath: filepath }
}

• Confidence: 81% confidence
• Finding: keyring

Session Persistence

Medium

• Category: Rogue Agent

Content

throw new Error(
    'No passphrase found. Set AUTO_RESPAWN_PASSPHRASE env var, ' +
      'write it to ~/.openclaw/auto-respawn/.passphrase, ' +
      'or run interactively.',
  )
}

• Confidence: 90% confidence
• Finding: write it to ~/.openclaw

Known Vulnerable Dependency: vitest==4.0.18 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: vitest==4.0.18

VirusTotal

48/48 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.