Security audit

Lista Wallet Connect

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill appears purpose-aligned, but it handles wallet transactions and local session data with enough unsafe or under-scoped behavior that users should review it before installing.

Install only if you trust this publisher and are comfortable with an agent-accessible wallet bridge. Use a dedicated wallet with limited funds/allowances, review every wallet prompt, avoid --open until shell execution is fixed, prefer your own WalletConnect project ID, avoid debug logs unless necessary, and treat ~/.agent-wallet contents as sensitive.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: src/commands/pair.ts:40
Finding: Shell Command Injection Through WalletConnect QR File Opening
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/storage.ts:21
Finding: Sensitive Wallet Session and Debug Data Stored Without Explicit Restrictive Permissions
Content: View full analysis
): void { try { appendFileSync(filePath, `${JSON.stringify(record)}\n`, "utf8"); } catch { // Never block command execution because of debug logging failures. } } ``` Debug logging captures complete stdout and stderr lines: ```ts const record: Record = { ts: new Date().toISOString(), pid: process.pid, skill, stream: streamName, line, }; if (isStructuredJson(parsed)) { record.json = parsed; } writeRecord(filePath, record); ``` It also stores the full command arguments: ```ts writeRecord(filePath, { ts: new Date().toISOString(), pid: process.pid, skill, stream: "stderr", line: "debug_log_enabled", config: { filePath, argv: process.argv.slice(2), }, }); ``` ### Technical Analysis Node.js file creation uses permissions derived from broad defaults and the process umask when no explicit mode is supplied. For example, under a common `0022` umask, newly created files may be readable by other local users and directories may be traversable. The session file contains wallet account identifiers, peer metadata, timestamps, chains, and WalletConnect session topics. The underlying WalletConnect store is also created beneath the same directory. These values are not private keys, but session topics and pairing/session metadata are security-sensitive and are explicitly ...[truncated 2636 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (54)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Use of an undeclared local config file such as ~/.agent-wallet/lending-config.json introduces hidden configuration dependencies and can cause this skill to inherit RPC settings from another wallet-related component. In a transaction skill, that creates a meaningful trust-boundary issue: transactions or simulations may be routed through endpoints the user did not expect or approve.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
> **Agent quick check:** `node dist/cli/cli.bundle.mjs version`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
> **Agent quick check:** `node dist/cli/cli.bundle.mjs version`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
> **Agent quick check:** `node dist/cli/cli.bundle.mjs version`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
> **Agent quick check:** `node dist/cli/cli.bundle.mjs version`

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · dist/cli/cli.bundle.mjs (reported line 43)May include surrounding context.
js
import { resolve, dirname } from "path"; import { fileURLToPath } from "url"; export function loadLocalEnv() { const envPath = resolve(dirname(fileURLToPath(import.meta.url)), "../../.env"); if (!existsSync(envPath)) return; const content = readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · dist/cli/env.js (reported line 5)May include surrounding context.
js
import { resolve, dirname } from "path"; import { fileURLToPath } from "url"; export function loadLocalEnv() { const envPath = resolve(dirname(fileURLToPath(import.meta.url)), "../../.env"); if (!existsSync(envPath)) return; const content = readFileSync(envPath, "utf8");

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/cli/env.ts (reported line 6)May include surrounding context.
ts
import { resolve, dirname } from "path"; import { fileURLToPath } from "url"; export function loadLocalEnv() { const envPath = resolve(dirname(fileURLToPath(import.meta.url)), "../../.env"); if (!existsSync(envPath)) return; const content = readFileSync(envPath, "utf8");

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file comment and the actual signed content are inconsistent: the comment describes wallet verification, but the message asks the user to authorize transaction requests. This mismatch is dangerous because it can mislead reviewers, integrators, and users about the real security semantics of the flow, especially in a wallet-connect skill whose core purpose includes signing and contract-call operations.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: defu==6.1.4 — 1 advisory(ies): CVE-2026-35209 (defu: Prototype pollution via `proto` key in defaults argument)

High

Category: Supply Chain
Confidence: 91% confidence
Finding: The lockfile includes defu 6.1.4, which is reported vulnerable to prototype pollution via a proto key in merge/default arguments. In this skill's dependency graph it is pulled in transitively through h3/unstorage, and while package-lock.json alone does not prove a reachable exploit path, WalletConnect-related tooling commonly processes external metadata and configuration objects, so retaining a polluted merge primitive is a real risk if attacker-controlled objects reach it.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: h3==1.15.5 — 4 advisory(ies): CVE-2026-33128 (h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream F); CVE-2026-86252 (h3: SSE Event Injection via Unsanitized Carriage Return (`\r`) in EventStream Da); CVE-2026-86251 (h3: Double Decoding in `serveStatic` Bypasses `resolveDotSegments` Path Traversa) +1 more

High

Category: Supply Chain
Confidence: 84% confidence
Finding: h3 1.15.5 is present transitively via unstorage and is associated with multiple server-side issues including SSE injection and path traversal-related flaws. Although this skill is primarily a wallet-connect/signing integration and package-lock.json does not show direct h3 use, the dependency is real and could become reachable if any embedded storage or server helper paths are exposed, making this a legitimate supply-chain risk.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 93% confidence
Finding: ws 8.18.3 is bundled through viem and is reported vulnerable to memory disclosure and memory-exhaustion denial of service. This skill's purpose involves WalletConnect and blockchain communication over WebSocket-capable stacks, so a ws vulnerability is contextually more dangerous because network-facing message handling is central to the skill's operation.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: ws 7.5.10 is present via WalletConnect's jsonrpc WebSocket connection stack and is flagged for memory exhaustion DoS. Because WalletConnect inherently relies on WebSocket-based relay communication with externally influenced traffic, an attacker could potentially abuse fragmented frames or chunking behavior against a consumer using this dependency, making this a credible vulnerability in context.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill requests capabilities that inherently use environment variables and network access, but the manifest does not declare any explicit tool scope or permissions boundary. In a wallet/transaction skill, missing scope declaration weakens reviewability and least-privilege enforcement, making it easier for the agent to perform networked actions or read configuration without clear authorization expectations.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The instruction to execute setup commands directly, automatically fix dependencies/environment, and not ask the user to run shell commands promotes autonomous system modification. In a wallet-connected skill, that increases risk because package installation, rebuilds, and environment changes can introduce unreviewed code execution or alter transaction-handling behavior before the user understands what happened.
Content: Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.
md
## Agent Execution Policy - Execute CLI/setup commands directly as the agent; do not ask the user to run shell commands. - If dependencies/build/env are missing, fix them automatically in the workspace. - Before any signing or on-chain write action, explain the action and get user consent. - Do not output raw JSON/internal payloads to users by default; present concise human-readable summaries.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation exposes a concrete WalletConnect project ID and says a default is already included in .env, but it does not warn about credential lifecycle, abuse, rotation, or visibility. Even if a WalletConnect project ID is not a high-value secret like a private key, embedding reusable service identifiers encourages hardcoding and can lead to unauthorized use, quota exhaustion, or tracing of activity through a shared project.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Intent-Code Divergence

Known Vulnerable Dependency: defu==6.1.4 — 1 advisory(ies): CVE-2026-35209 (defu: Prototype pollution via `__proto__` key in defaults argument)

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

Undeclared Tool Scope

Autonomous Decision Making

Missing User Warnings

Known Vulnerable Dependency: defu==6.1.4 — 1 advisory(ies): CVE-2026-35209 (defu: Prototype pollution via `proto` key in defaults argument)