Security audit
Security checks for vulnerabilities and agentic risk
This wallet skill is purpose-aligned but needs review because it can control real cryptocurrency assets and has unsafe scripting and confirmation gaps.
Install only if you are comfortable giving an agent authenticated access to your Sage wallet. Use a test wallet first, avoid remote RPC unless you fully trust the endpoint, do not retrieve mnemonics through chat or logs, and require manual review of address, amount, fee, network, fingerprint, and assets before any signing, broadcast, offer acceptance, deletion, or database operation.
scripts/sage-rpc.sh:10Arbitrary Command Execution Through Unsafe Configuration Evaluation
sub-skills/sage-auth/SKILL.md:23Wallet Mnemonic Can Be Retrieved and Printed Without a Dedicated Secret-Handling Boundary
sub-skills/sage-xch/SKILL.md:24Financial Operations Default to Signing and Broadcasting Without Mandatory Final Confirmation
The troubleshooting guide recommends curl -k, which disables TLS certificate verification. Because the skill supports configurable remote RPC endpoints, this guidance can train users to bypass mTLS trust checks and accept spoofed or man-in-the-middle endpoints, undermining the security model protecting wallet RPC access.
curl -k https://127.0.0.1:9257/get_version
/sage configThe declared description presents a full-featured Chia wallet RPC integration skill. However, the supplied code chunk does not interact with a wallet, RPC endpoint, blockchain, tokens, NFTs, DIDs, or offers. It is strictly a configuration test harness for sage-config.sh, focused on config file creation and validation of helper functions and default paths. While wallet configuration is mentioned in the description, this code only tests config utilities and does not implement the broader stated functionality, so the actual behavior is materially narrower and different from the declared purpose.
The quick-start sequence places a real transfer example immediately after setup, which can normalize live fund movement before the user sees the later security caveats. In an agent-driven wallet skill, examples are often copied verbatim, so showing a send command without an adjacent warning increases the risk of accidental irreversible transfers to the wrong address or on the wrong wallet.
The command reference includes actions such as sending XCH/CAT, issuing tokens, minting NFTs, transferring assets, accepting offers, and canceling on-chain offers. Although the README has general security notes later, this section does not clearly warn users that these commands may move funds or create irreversible on-chain state changes, and the roadmap explicitly suggests confirmation prompts are not yet implemented.
The skill documents shell-based scripts and commands but does not declare any explicit tool scope or permissions. In a wallet-management context, undeclared shell capability increases the risk of unexpected local command execution against sensitive files such as wallet certificates, keys, and configuration.
The skill advertises capabilities that can move funds, mint assets, and submit transactions without prominently warning about irreversible wallet-affecting actions. In a financial/blockchain context, insufficient user warning can lead to accidental approvals, transfers, or asset creation with direct monetary loss.
Documenting WalletConnect signing without an explicit caution is dangerous because external signing requests may originate from untrusted dApps or counterparties. Users may approve signatures that authorize transfers or other high-risk blockchain actions, leading to theft or irreversible asset loss.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| Sub-Skill | When to Load |
|-----------|--------------|
| [sage-auth](sub-skills/sage-auth/SKILL.md) | Login, logout, key management, mnemonics |
| [sage-xch](sub-skills/sage-xch/SKILL.md) | Send/receive XCH, combine, split coins |
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| Sub-Skill | When to Load |
|-----------|--------------|
| [sage-auth](sub-skills/sage-auth/SKILL.md) | Login, logout, key management, mnemonics |
| [sage-xch](sub-skills/sage-xch/SKILL.md) | Send/receive XCH, combine, split coins |
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
|-----------|--------------|
| [sage-auth](sub-skills/sage-auth/SKILL.md) | Login, logout, key management, mnemonics |
| [sage-xch](sub-skills/sage-xch/SKILL.md) | Send/receive XCH, combine, split coins |
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-auth](sub-skills/sage-auth/SKILL.md) | Login, logout, key management, mnemonics |
| [sage-xch](sub-skills/sage-xch/SKILL.md) | Send/receive XCH, combine, split coins |
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-xch](sub-skills/sage-xch/SKILL.md) | Send/receive XCH, combine, split coins |
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-cat](sub-skills/sage-cat/SKILL.md) | CAT token operations |
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-nft](sub-skills/sage-nft/SKILL.md) | NFT minting, transfers, collections |
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-did](sub-skills/sage-did/SKILL.md) | DID creation and management |
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
| [sage-system](sub-skills/sage-system/SKILL.md) | Sync status, version, database |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-offers](sub-skills/sage-offers/SKILL.md) | Offer creation, acceptance, cancellation |
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
| [sage-system](sub-skills/sage-system/SKILL.md) | Sync status, version, database |
| [sage-walletconnect](sub-skills/sage-walletconnect/SKILL.md) | WalletConnect integration |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-options](sub-skills/sage-options/SKILL.md) | Options protocol operations |
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
| [sage-system](sub-skills/sage-system/SKILL.md) | Sync status, version, database |
| [sage-walletconnect](sub-skills/sage-walletconnect/SKILL.md) | WalletConnect integration |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-coins](sub-skills/sage-coins/SKILL.md) | Coin queries, address validation |
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
| [sage-system](sub-skills/sage-system/SKILL.md) | Sync status, version, database |
| [sage-walletconnect](sub-skills/sage-walletconnect/SKILL.md) | WalletConnect integration |
## First Run
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| [sage-txn](sub-skills/sage-txn/SKILL.md) | Transaction signing, submission |
| [sage-network](sub-skills/sage-network/SKILL.md) | Peer and network settings |
| [sage-system](sub-skills/sage-system/SKILL.md) | Sync status, version, database |
| [sage-walletconnect](sub-skills/sage-walletconnect/SKILL.md) | WalletConnect integration |
## First Run
This reference enumerates highly sensitive and destructive wallet capabilities such as generating mnemonics, importing keys, exposing secret keys, deleting keys, resyncing, and deleting the wallet database without any cautions about irreversible loss, credential exposure, or the need for explicit user confirmation. In a wallet automation skill, terse documentation of these actions materially increases the chance that an agent or user will invoke them unsafely, leading to fund loss or mnemonic compromise.
The transaction section lists endpoints that send assets, merge or split coins, and finalize clawbacks with no warning that blockchain actions may be irreversible, fee-bearing, or capable of moving funds to unintended recipients. Because this skill is designed to drive a real wallet via RPC, missing warnings and confirmation expectations can directly contribute to accidental transfers or irreversible state changes.
The NFT, DID, offer, and direct-broadcast capabilities include asset transfers, offer acceptance/cancellation, signing, and immediate transaction broadcast, yet the reference does not warn that these actions can transfer ownership, commit the wallet to trades, or publish irreversible transactions. In the context of a wallet skill, omission of such warnings is especially dangerous because the documented endpoints are operational controls rather than read-only queries.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Make the RPC call
local response
response=$(curl -s -X POST \
--cert "$cert_path" \
--key "$key_path" \
--cacert "$cert_path" \
The delete_key endpoint is presented as a normal key-management action without a clear warning that deleting a wallet key can cause loss of access if the mnemonic/backup is not محفوظ elsewhere. Because this skill manages real blockchain wallet identities, underemphasizing the destructive nature of key deletion materially raises the risk of irreversible user harm.
The skill documents a destructive delete_database operation without an explicit warning that it is irreversible and can remove wallet state for a given fingerprint/network. In a wallet-management context, missing safety language increases the chance an agent or user invokes it casually, leading to loss of local wallet data, required resync effort, or accidental operational disruption.
No suspicious patterns detected.