v1.0.0

Quack Wallet

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 6:07 AM.

Analysis

Quack Wallet matches its stated wallet purpose, but it reads a local API key and can transfer token funds without declared credential requirements or explicit approval safeguards.

GuidanceReview carefully before installing. Only use a limited-scope Quack API key if available, confirm every transfer manually, and avoid enabling this skill for autonomous payment decisions unless you have strong spending limits and trust the source.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityHighConfidenceHighStatusConcern

scripts/transfer.mjs

if (!args.to || !args.amount) { ... } ... const res = await fetch(url, { method: 'POST', ... body: JSON.stringify({ to: args.to, amount: parseFloat(args.amount), memo: args.memo }) });

After only checking that recipient and amount are present, the script directly sends a transfer request; the artifacts do not show an explicit user-confirmation, limit, or allowlist safeguard for this high-impact action.

User impactIf invoked with a recipient and amount, the skill can move Quack tokens from the user's agent wallet.

RecommendationRequire explicit user confirmation immediately before every transfer, validate recipient and amount, and consider limits or allowlists for payments.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none

The artifact provides no public source or homepage provenance, which is especially relevant for a skill that handles credentials and token transfers.

User impactUsers have less context for verifying who maintains the wallet integration or where to audit updates.

RecommendationPrefer skills with verifiable source provenance, or manually review the included scripts before use.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityHighConfidenceHighStatusConcern

SKILL.md

Credentials at `~/.openclaw/credentials/quack.json`: {"apiKey": "your-quack-api-key"}

The skill requires a local API key that grants wallet authority, but the registry metadata declares no primary credential, required environment variable, or required config path.

User impactInstalling or using the skill gives it access to a bearer credential that can authorize balance checks and token transfers on the user's behalf.

RecommendationDeclare the Quack API key as a primary credential/config requirement, document its scope, and use the least-privileged token possible.