T08 · Insecure Dependencies
Error
- Location
SKILL.md:6- Finding
Unpinned Third-Party Package Executes with Access to Wallet Assets and Secrets
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Wallet
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed wallet and trading integration, but it asks an agent to create and expose wallet secrets automatically and relies on an unpinned package for high-impact financial actions.
Install only if you are comfortable with an agent-controlled wallet integration that can create wallets, reveal recovery material, export keys, and move funds. Pin and audit the npm package first, disable or review automatic credential and wallet creation, avoid sending seed phrases or private keys through chat, and require explicit confirmation plus independent transaction review before any funded operation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:32- Finding
Automatic Wallet Creation Can Expose a Seed Phrase Through Retained Agent Output
- Content
View full analysis
" // " EVM: " // " Seed phrase: (save this securely — it won't be shown again)" } } else { // Wallet exists — show addresses // "Your wallet:" // " Solana: " // " SOL balance: " } ``` ### Technical Analysis The workflow treats every unsuccessful `wallet_get()` response as proof that no wallet exists. It does not distinguish a genuine “wallet not found” response from authorization failures, network failures, rate limits, server errors, or malformed responses. It then creates a new wallet without requiring explicit user approval. After creation, the instructions direct the agent to show the seed phrase to the user in ordinary conversational output. A seed phrase is equivalent to complete control of the associated wallet. Although another section says never to log seed phrases, presenting one through an agent conversation can place it in chat history, model traces, telemetry, support logs, browser history, screenshots, or other retained systems. This creates an internal inconsistency in the security guidance. The behavior exceeds minimum privilege for first interaction: checking wallet status does not require immediate creation of a wallet, and displaying public addresses does not require exposing recover ...[truncated 1481 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
The skill instructs automatic credential creation and storage in a predictable file under the user's home directory. Any skill that creates and relies on local credential material increases exposure to credential theft, cross-process reuse, and accidental inclusion in backups or logs, especially in shared or sandboxed agent hosts.
- Content
This installs the plugin and all its dependencies. No additional packages needed.
Authentication is automatic. On first use, the plugin auto-registers for an API key and saves it to
~/.loomlay/credentials.json. No manual setup required.To use a specific API key instead of auto-registration:
bash
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
text **Always run this check before any wallet or trading operation.** If `wallet_get()` fails with UNAUTHORIZED, the API key may need to be re-registered — delete `~/.loomlay/credentials.json` and retry. ## How to Use the Tools
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
}
text **Always run this check before any wallet or trading operation.** If `wallet_get()` fails with UNAUTHORIZED, the API key may need to be re-registered — delete `~/.loomlay/credentials.json` and retry. ## How to Use the Tools
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
to be re-registered — delete
~/.loomlay/credentials.jsonand retry.How to Use the Tools
All 27 tools are exported as flat async functions from the plugin package. Use them in Node.js like this:
javascript const { wallet_get, swap_quote, swap, dex_trending, token_search } = require('@loomlay/openclaw-wallet-plugin'); // Check wallet balance const wallet = await wallet_get(); // wallet.data.balances.solana.sol // Get trending tokens const trending = await dex_trending({ chain: 'solana', limit: 10 }); // trending.data.pairs[...]Every tool returns a standardized response:
javascript { success: true, // or false data: { ... }, // result data (when success is true) error: { // error info (when success is false) message: "...", code: "RATE_LIMITED", retryAfter: 30 // seconds (for rate limits) } }Always check
result.successbefore usingresult.data.Important: Verify Before Executing
For any action
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Documenting private-key export capability without a strong, front-and-center warning normalizes a highly sensitive operation that can irreversibly compromise all wallet funds if mishandled. In an agent skill context, even a single accidental display, log, or transmission of exported keys can lead to complete account takeover across supported chains.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description says to use the skill when agents need to "interact with wallets, execute trades, research tokens, or launch tokens," which is a very broad invocation scope rather than a specific trigger or constrained context. Because this is manifest-style metadata in a markdown file, the lack of explicit trigger boundaries or exclusions could cause unintended activation for general finance or research requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic API-key registration and storage to ~/.loomlay/credentials.json introduces implicit credential creation and local persistence without a strong warning or consent model. In an agent environment, silent credential writes can surprise operators, create unmanaged secrets on disk, and broaden the blast radius if the host or home directory is later accessed.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The skill directs agents to check for or create a wallet automatically on first interaction or skill load, which establishes persistent financial state without a narrowly scoped request from the user. In agent environments, auto-provisioning wallets can create unmanaged assets, trigger unintended account creation, and normalize stateful side effects before clear consent is obtained.
- Content
On first interaction with a user (or when the skill is first loaded), run this setup sequence:
javascript const { wallet_get, wallet_create } = require('@loomlay/openclaw-wallet-plugin'); // 1. Check if a wallet already exists const existing = await wallet_get();
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md For any action involving funds: 1. **Get a quote first** — show the user what will happen 2. **Get user confirmation** — never execute without approval 3. **Execute** — run the transaction 4. **Verify** — check the result and new balances
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill advertises wallet and trading functionality but also exposes a generic rpc_call primitive that can invoke arbitrary chain RPC methods. This materially expands capability beyond the curated toolset, enabling low-level blockchain interactions that may bypass higher-level safety expectations, confirmation flows, or scope assumptions made by the agent integrator.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The documentation gives mixed signals by declaring an API key requirement while later stating authentication is automatic via auto-registration and local credential storage. This ambiguity can cause operators to unknowingly permit silent account creation and credential persistence, undermining informed consent and secure deployment expectations.
- Content
Static analysis
No suspicious patterns detected.