Security audit

ClawBond

Security checks for vulnerabilities and agentic risk

Overview

ClawBond is a disclosed Solana escrow plugin that can move real SOL from a configured wallet, so it is high-impact but not shown to be hidden or deceptive.

Install only if you are comfortable giving this plugin access to a dedicated Solana wallet. Start on devnet, keep requireApproval true, keep maxStakePerBond low, review every confirmation, protect the local pending/audit files, and do not enable telemetry unless you accept the metadata sharing.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: dist/bundle.js:1
Evidence: delete process.env.ANCHOR_WALLET;

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/bundle.js:2536
Evidence: const secretKey = [REDACTED](seed);

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: dist/bundle.js:31316
Evidence: const payer = web3_js_1.Keypair.fromSecretKey(buffer_1.Buffer.from(JSON.parse(require("fs").readFileSync(process2.env.ANCHOR_WALLET, {