ClawHub
Back to skill

Security audit

AWP Wallet Skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real crypto wallet skill, but it needs Review because it can move funds or sign data and its installer and session handling are under-scoped for that level of authority.

Review before installing. Do not run the installer with sudo, avoid passing seed phrases, passwords, API keys, or session tokens in logged command lines, and treat approve/sign requests like fund transfers. Use separate low-value wallet profiles until the installer profile validation, sudo fallback, secret handling, and signing confirmations are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
install.sh:158
Finding

Unsanitized Wallet Profile Identifier Allows Path Traversal and Arbitrary .env File Overwrite

Content
View full analysis
"$PROFILE_DIR/.session-secret" chmod 0600 "$PROFILE_DIR/.session-secret" fi # Write PIMLICO_API_KEY to env file if provided if [[ -n "$PIMLICO_API_KEY" ]]; then echo "PIMLICO_API_KEY=$PIMLICO_API_KEY" > "$PROFILE_DIR/.env" chmod 0600 "$PROFILE_DIR/.env" log "Pimlico API key saved to $PROFILE_DIR/.env" fi ``` ### Technical Analysis The installer accepts `--agent-id` and `--session-id` without validating them before incorporating the selected value into `PROFILE_DIR`. A value containing path traversal sequences such as `../` can cause the resulting profile path to escape `$HOME/.o ...[truncated 2271 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/wallet-cli.js:68
Finding

Wallet Mnemonics, API Keys, Passwords, and Full-Scope Session Tokens Are Exposed Through Process Arguments

Content
View full analysis
Use explicit password (default: auto-managed) # --mnemonic Import existing wallet from seed phrase # --pimlico Set PIMLICO_API_KEY for gasless transactions # --agent-id Wallet profile ID (multi-agent isolation) # --session-id Wallet session ID (per-session isolation) ``` ```bash --password) WALLET_PASSWORD="$2"; USER_PROVIDED_PASSWORD=true; shift 2 ;; --mnemonic) MNEMONIC="$2"; shift 2 ;; --pimlico) PIMLICO_API_KEY="$2"; shift 2 ;; ``` ```bash INIT_RESULT=$(run_cli_pw import --mnemonic "$MNEMONIC" 2>&1) || { err "Wallet import failed: $INIT_RESULT"; } ``` ```javascript cli.command("import") .description("Import wallet from mnemonic") .requiredOption("--mnemonic ", "Mnemonic seed phrase") .action(async (opts) => { try { const { importWallet } = await import("./lib/keystore.js") json(await importWallet(opts.mnemonic)) } catch (e) { fail(e.message) } }) ``` ```javascript cli.command("unlock") .description("Unlock wallet and get session token") .option("--duration ", "Session duration in seconds", "3600") .option("--scope ", "Session scope (read|transfer|full)", "full") .action(async (opts) => { try { const duration = parseInt(opts.duration) if (isNaN(duration) || duration < 1) throw new Error("--duration must be a positive integer (seconds).") const { unlockWallet } = await import("./lib/session.js") json(unlockWallet(duration, opts.scope)) } catch (e) { fail(e.message) } }) ``` ```bash TOKEN=$(awp-wallet unlock --duration ...[truncated 3380 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (52)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

Local transaction/history logging and integrity verification are not inherently malicious, but when not clearly disclosed they can create privacy and forensic-risk issues by persisting wallet activity on disk. In an agent environment, stored histories may reveal addresses, counterparties, transaction patterns, and other sensitive financial metadata.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 86)May include surrounding context.

sh
log "Copying local repo to $INSTALL_DIR..."
    mkdir -p "$INSTALL_DIR"
    cp -r "$SCRIPT_DIR/." "$INSTALL_DIR/"
    rm -rf "$INSTALL_DIR/node_modules" "$INSTALL_DIR/.git"
  fi
  cd "$INSTALL_DIR"
else

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The installer writes the Pimlico API key directly into a plaintext .env file under the wallet profile. Even with 0600 permissions, this leaves a long-lived secret on disk that may be exposed through backups, endpoint compromise, debugging artifacts, or later unsafe file handling by the wallet toolchain.

Content

Scanner excerpt · install.sh (reported line 191)May include surrounding context.

sh
# Write PIMLICO_API_KEY to env file if provided
if [[ -n "$PIMLICO_API_KEY" ]]; then
  echo "PIMLICO_API_KEY=$PIMLICO_API_KEY" > "$PROFILE_DIR/.env"
  chmod 0600 "$PROFILE_DIR/.env"
  log "Pimlico API key saved to $PROFILE_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 192)May include surrounding context.

sh
# Write PIMLICO_API_KEY to env file if provided
if [[ -n "$PIMLICO_API_KEY" ]]; then
  echo "PIMLICO_API_KEY=$PIMLICO_API_KEY" > "$PROFILE_DIR/.env"
  chmod 0600 "$PROFILE_DIR/.env"
  log "Pimlico API key saved to $PROFILE_DIR/.env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · install.sh (reported line 193)May include surrounding context.

sh
# Write PIMLICO_API_KEY to env file if provided
if [[ -n "$PIMLICO_API_KEY" ]]; then
  echo "PIMLICO_API_KEY=$PIMLICO_API_KEY" > "$PROFILE_DIR/.env"
  chmod 0600 "$PROFILE_DIR/.env"
  log "Pimlico API key saved to $PROFILE_DIR/.env"
fi

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins ws 8.18.3, which the provided advisory data identifies as affected by an uninitialized memory disclosure and a memory-exhaustion denial-of-service issue. In a wallet skill that may maintain websocket connections to RPC providers for chain state, events, or transaction updates, a vulnerable ws dependency can expose sensitive process memory or allow remote service disruption, increasing risk beyond a typical app because wallet-related processes may handle signing context, addresses, and transaction metadata.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile also includes ws 8.17.1, which the advisory data marks as vulnerable to the same memory disclosure and memory-exhaustion DoS issues. Because this skill is a crypto wallet utility and may interact with untrusted remote websocket endpoints or relay infrastructure, exploitation could leak in-process data or degrade wallet availability during balance checks, signing flows, or transaction monitoring.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

An export command that returns the wallet mnemonic without a strong warning or additional safeguards exposes the single most sensitive recovery secret in the system. In an agent-integrated wallet context, this is especially risky because outputs may be surfaced to other tools, logs, or untrusted prompt contexts, enabling total wallet takeover.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill invokes shell commands, reads environment variables, and performs installation from remote sources, but it declares no explicit tool scope or permissions boundaries. In an agent setting, this increases the chance the skill is invoked with broader-than-necessary execution privileges, enabling software installation, filesystem modification, and wallet-affecting operations without clear containment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation description is broad enough to auto-trigger for many natural-language wallet-related phrases, including sensitive actions like sending funds, approvals, and signing. In agent systems, broad triggers increase the chance of unintended invocation on ambiguous prompts, phishing-style requests, or attacker-crafted content that induces a wallet action workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill offers message and typed-data signing without an explicit warning that signatures can authorize asset transfers, approvals, login delegation, or account-control changes indirectly. Users and agents often treat signing as harmless, so missing risk framing materially increases susceptibility to phishing and malicious dApp payloads.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/default-config.json (reported line 32)May include surrounding context.

json
"priority": 1,
      "timeout": 5000,
      "envKey": "PIMLICO_API_KEY",
      "bundlerUrlTemplate": "https://api.pimlico.io/v2/{chainId}/rpc?apikey={key}",
      "paymasterUrlTemplate": "https://api.pimlico.io/v2/{chainId}/rpc?apikey={key}"
    },
    {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/default-config.json (reported line 33)May include surrounding context.

json
"priority": 1,
      "timeout": 5000,
      "envKey": "PIMLICO_API_KEY",
      "bundlerUrlTemplate": "https://api.pimlico.io/v2/{chainId}/rpc?apikey={key}",
      "paymasterUrlTemplate": "https://api.pimlico.io/v2/{chainId}/rpc?apikey={key}"
    },
    {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/default-config.json (reported line 48)May include surrounding context.

json
"priority": 3,
      "timeout": 8000,
      "envKey": "STACKUP_API_KEY",
      "bundlerUrlTemplate": "https://api.stackup.sh/v1/node/{key}",
      "paymasterUrlTemplate": "https://api.stackup.sh/v1/paymaster/{key}"
    }
  ],

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/default-config.json (reported line 49)May include surrounding context.

json
"priority": 3,
      "timeout": 8000,
      "envKey": "STACKUP_API_KEY",
      "bundlerUrlTemplate": "https://api.stackup.sh/v1/node/{key}",
      "paymasterUrlTemplate": "https://api.stackup.sh/v1/paymaster/{key}"
    }
  ],

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
96% confidence
Finding

The script attempts 'sudo npm link' if unprivileged registration fails, which can execute package-defined install/link behavior with elevated privileges. In a wallet installer that pulls code from a repository and runs npm install, this materially increases the blast radius of any compromised dependency or malicious package script.

Content

Scanner excerpt · install.sh (reported line 109)May include surrounding context.

sh
if npm link 2>/dev/null && command -v awp-wallet &>/dev/null; then
  REGISTERED=true
  log "Registered via npm link: $(which awp-wallet)"
elif sudo npm link 2>/dev/null && command -v awp-wallet &>/dev/null; then
  REGISTERED=true
  log "Registered via npm link (sudo): $(which awp-wallet)"
fi

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Creating a symlink into ~/.local/bin establishes a persistent executable entrypoint in a user-writable directory. While common for CLI installers, it is still a persistence action, and in an agent-install context tied to crypto wallet operations it deserves explicit user awareness because later code updates to the install directory will affect future command execution.

Content

Scanner excerpt · install.sh (reported line 116)May include surrounding context.

sh
# Fallback: symlink into ~/.local/bin and ensure it's in PATH
if [[ "$REGISTERED" == false ]]; then
  mkdir -p "$HOME/.local/bin"
  ln -sf "$INSTALL_DIR/scripts/wallet-cli.js" "$HOME/.local/bin/awp-wallet"
  log "Registered: ~/.local/bin/awp-wallet"