Security audit

Sage Wallet

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Sage wallet integration, but it gives an agent broad cryptocurrency wallet authority with weak safety boundaries.

Install only if you intentionally want an agent to operate a live Sage/Chia wallet. Prefer testnet first, keep the default RPC on localhost, do not point it at untrusted RPC servers, protect the wallet key and mnemonic, and require explicit review of recipient, asset, amount, fee, network, and transaction summary before any signing or submission.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill explicitly references shell scripts (`scripts/sage-config.sh`, `scripts/sage-rpc.sh`) and shell-based platform detection, yet no declared permissions are documented. That mismatch increases the risk of undeclared command execution and makes it harder for users or the host system to reason about the skill's authority boundaries.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The direct-execution CLI exposes a generic `call` command that forwards arbitrary endpoints to `sage_rpc`, which in turn can reach any RPC path at the configured URL. In a wallet skill, this exceeds the narrowly implied wallet-operation interface and can be abused to invoke sensitive or unexpected RPC methods, especially when combined with configurable `--rpc`, `--cert`, and `--key` options.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README documents commands that can move funds, mint or transfer assets, cancel offers, and alter wallet state, but it does not consistently warn users about irreversibility, on-chain finality, fees, or the need for explicit confirmation before execution. In a cryptocurrency wallet skill, incomplete safety guidance increases the chance of accidental high-impact actions through natural-language invocation or command copy/paste.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The skill advertises very broad natural-language triggers such as 'send XCH' and 'create an offer,' which can cause the agent to activate the wallet skill from ambiguous user input. In a financial context, unintended activation is especially risky because it may steer a conversation toward asset-moving workflows without an explicit command boundary.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill supports irreversible blockchain operations including transfers, minting, offers, and signing, but the documentation does not present a prominent warning about permanent asset loss or transaction finality. In a wallet context, omission of such warnings materially increases the chance of accidental or misunderstood asset-changing actions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This reference file prominently documents highly sensitive and destructive wallet RPC operations such as `generate_mnemonic`, `import_key`, `delete_key`, `get_secret_key`, and `delete_database` without any cautionary guidance, privilege notes, or confirmation requirements. In the context of an agent skill that can be invoked through natural language for wallet management, this increases the chance that an agent or user will trigger key exfiltration, wallet deletion, or irreversible state changes without understanding the risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The `call` interface permits user-supplied endpoint, payload, and RPC target to be sent with client authentication material, without any warning or confirmation before transmitting to the network. In this skill context, that means an operator can be tricked into sending authenticated wallet requests to an attacker-controlled endpoint or performing destructive wallet actions through arbitrary JSON payloads.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill documents destructive operations like `delete_database` and potentially disruptive recovery actions like `resync` without clearly warning that they can remove local wallet data, require lengthy recovery, or cause loss of unsynced state. In a wallet-management skill, this is risky because an agent or user may invoke these commands with incomplete understanding, increasing the chance of accidental destructive actions against high-value financial assets.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation exposes high-risk wallet operations such as sending CATs and issuing new tokens, and examples default to `auto_submit: true` without any warning that these actions can create irreversible on-chain transactions. In an agent skill context, this increases the chance that a user or downstream agent triggers asset transfers or token issuance without explicit confirmation or understanding of fees, finality, and recipient correctness.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill documents DID transfer operations with `auto_submit: true` and no explicit warning that this changes ownership of on-chain identities and may immediately broadcast an irreversible transaction. In a wallet skill, presenting destructive asset/identity transfer flows without mandatory confirmation language materially increases the risk of accidental loss through user misunderstanding, prompt ambiguity, or unsafe agent automation.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The creation and normalization examples use `auto_submit: true` without warning that the agent may immediately sign and broadcast a transaction that incurs fees. In a blockchain wallet context, even non-transfer operations can trigger unintended on-chain actions and spend funds if an agent or user follows the examples blindly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill exposes `set_network` and `set_network_override` operations without any safety warning that switching networks can redirect wallet activity, alter synchronization behavior, and cause users to transact or inspect balances on the wrong chain. In a wallet-management skill, that omission is security-relevant because an agent or user could mistakenly operate on testnet or an unintended network while believing they are on mainnet.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documented `set_change_address` operation can redirect change outputs to an arbitrary address, yet the skill provides no warning that an incorrect or attacker-supplied address could permanently divert funds. Because change addresses are used automatically during transactions, misuse can silently cause loss of wallet funds even if the primary payment destination was correct.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill includes minting and transfer examples that can trigger real on-chain NFT actions with fees and irreversible asset movement, but it does not warn users that these operations are live, may spend funds, and cannot be undone once submitted. In a wallet-integrated skill, omission of such safeguards increases the chance of accidental loss, mistaken transfers, or unintended minting when an agent or user follows examples too literally.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill documents `take_offer` and `cancel_offer` operations that can trigger on-chain transactions and fees, but it does not clearly warn users that these actions may be irreversible once submitted. In a wallet/trading context, missing explicit confirmation and risk language increases the chance of unintended asset transfers, fee spending, or offer invalidation through normal use or prompt-driven automation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The examples demonstrate minting and exercising options with `auto_submit: true`, which can immediately create and broadcast financially consequential blockchain transactions if copied verbatim or adapted with real values. In a wallet skill, omission of an explicit warning or safer dry-run pattern increases the risk of unintended irreversible on-chain actions and asset loss.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The transfer example shows sending options to a blockchain address with `auto_submit: true` but provides no warning that this causes immediate asset transfer on-chain. Because blockchain transfers are typically irreversible, users may mistakenly execute a live transfer by following the example, leading to permanent loss or misdelivery of assets.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This skill documents signing and broadcasting wallet transactions without any explicit warning that these actions can move funds irreversibly. In a wallet skill, omission of consent and effect warnings materially increases the risk that an agent or user triggers fund movement without understanding that signing and submission have immediate financial consequences.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The example uses `auto_submit: true`, which combines signing and broadcasting into one step, but does not warn that this can immediately send assets once invoked. In the context of a blockchain wallet skill, demonstrating the most dangerous mode without a caution or confirmation pattern makes accidental or unauthorized fund movement more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents `send_transaction_immediately` as a direct broadcast mechanism but provides no warning that invoking it can submit a live blockchain transaction with immediate, potentially irreversible on-chain effects. In a wallet/dApp integration context, omission of this warning increases the chance that an agent or user treats the endpoint as a harmless preview or routine RPC call, which could lead to unintended asset transfers or premature broadcast of maliciously prepared spend bundles.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The message-signing endpoints are presented without warning that signatures can prove address or key control to third-party dApps and may be used for login, authorization, reputation linkage, or social-engineering flows. In a WalletConnect setting, this omission is security-relevant because users or agents may sign attacker-chosen messages believing there is no consequence beyond a harmless check.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This skill documents funds-moving RPC calls with `auto_submit: true` as the default in multiple examples, including direct send operations, without any adjacent warning to preview, confirm, or require explicit user approval before broadcast. In a wallet skill, this increases the chance that an agent or user copies an example that immediately signs and submits a real transaction, causing unintended asset transfers or premature clawback/finalization actions.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.