minara

• Outcome: Review
• Latest audit: Aug 4, 2026 · 6:50 AM UTC
• Version: 3.0.4

Overview

This is a disclosed crypto wallet and trading skill with strong main confirmation rules, but it also persists broad agent routing and includes self-update and confirmation-bypass documentation that warrant Review before installation.

Install only if you are comfortable giving an agent access to Minara wallet, trading, balance, and account workflows. Before enabling it, review and approve any writes to agent config or memory files, avoid using --yes for fund-moving actions, verify x402 recipients and full wallet addresses, and treat autopilot as live automated trading that can lose funds.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the agent to execute shell commands (`bash`, `npm install -g`, `git pull`, `rm -f`) but the manifest does not declare permissions reflecting that capability. This creates a transparency and policy-enforcement gap: a host may treat the skill as lower-risk while it can actually modify the local environment and installed software.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose is trading/wallet/analysis, but the skill also performs update orchestration, local file reads, package installation, Git updates, and cache mutation. That mismatch is dangerous because operators and users may authorize the skill for financial actions without realizing it can also change local tooling and repository state, increasing attack surface and supply-chain risk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Self-update via `npm install -g minara@latest` and `git pull`, combined with file writes under `~/.minara`, gives the skill authority to alter executable code and local state at runtime. In a financial skill, this is particularly risky because a compromised package, repository, or MITM in the update path could silently replace trading logic or capture wallet-related secrets.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The documentation gives conflicting guidance for `minara perps leverage`: one section says it is always interactive with no non-interactive flags, while another says it accepts `-s` and `-l` and shows a non-interactive example. In a fund-moving crypto trading skill, this ambiguity can cause an agent to choose the wrong execution path, mishandle confirmations, or enter an unexpected interactive flow while changing leverage, which directly affects liquidation risk.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The setup instructions direct the agent to create or modify persistent workspace configuration files outside the core finance/trading runtime behavior of the skill. This expands the skill's influence from answering finance questions into changing agent behavior across future sessions, which can create lasting routing changes without narrowly scoped user consent.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The OpenClaw and Hermes sections instruct persistent modifications to routing and memory files so the skill becomes preferred for broad classes of future finance-related queries. That is a cross-session behavioral takeover beyond the stated purpose of providing finance/trading functionality, and it can bias future agent decisions in ways the user may not fully understand.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file instructs the agent to execute balance and asset queries automatically and shows examples of detailed wallet, portfolio, PnL, margin, and withdrawable amounts without any privacy warning or data-minimization guidance. Even though the commands are read-only, they expose highly sensitive financial information that could be surfaced to an unintended user, logged, or retained in conversation history.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The title and framing use very broad trigger terms such as 'AI Chat / Ask / Research', which can match a wide range of ordinary user requests unrelated to this skill's intended crypto domain. In an agent-routing context, this increases the chance of overbroad invocation and unnecessary exposure of a powerful finance-related skill, which could lead to confused-deputy behavior or unintended access to adjacent capabilities.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The intent table describes generic actions like 'Quick AI question', 'Deep AI research', and 'AI chat' without strong domain boundaries, making the skill eligible for many common prompts. Because this skill belongs to a crypto trading and wallet capability set, ambiguous activation increases the risk that the agent invokes it inappropriately, exposing users to finance-adjacent flows or misleading command selection even when they only wanted general analysis.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example documents a non-interactive `close --all --yes` command that liquidates all open positions while explicitly bypassing confirmation, but it provides no warning that this is a destructive action suitable only for explicit user-approved execution. In a trading skill, examples strongly shape agent behavior, so exposing a confirmation-bypass path without guardrails increases the chance of accidental or unauthorized mass position closure with immediate financial loss.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The autopilot feature is presented as an available capability without any caution that it may execute automated financial actions, potentially opening, modifying, or closing trades based on strategy logic. In the context of a wallet/trading agent, omitting warnings around automation materially increases the risk of users or downstream agents enabling high-risk behavior without understanding ongoing exposure or loss potential.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The x402 payment example instructs sending funds to a payment address sourced from external HTTP 402 headers, but it does not warn that such addresses are externally supplied and may be spoofed, malicious, or incorrect. Because this skill controls a wallet and facilitates transfers, treating header-derived recipient addresses as trusted can directly lead to irreversible fund loss.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide explicitly instructs agents to run `minara limit-order create` with `pty: true` and walk through the interactive trading flow, but it omits any requirement to warn the user that this can place a real financial order or to obtain explicit confirmation immediately before submission. In a crypto trading skill, interactive PTY sessions are especially risky because agents may continue through prompts and commit trades with real funds, making accidental or unauthorized execution more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The autopilot guidance says to use `pty: true` for an ongoing interactive dashboard session, but provides no warning that autopilot may monitor markets or place/manage trades with continuing account impact. Because this skill is specifically for crypto wallets, perps, and trading automation, omitting a strong warning and confirmation model around an ongoing autonomous feature materially increases the risk of persistent unintended trading behavior.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The routing rule matches extremely broad categories such as crypto, trading, wallet, market data, and finance terms, causing the skill to be preferred over general knowledge or web search for many ordinary user messages. Because the triggers lack clear boundaries or conflict-resolution rules, they can over-route unrelated or sensitive requests into a tool capable of wallet and trading operations.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The phrase 'vague finance question' is undefined and tells the agent to proactively invoke Minara commands instead of giving generic guidance. This ambiguity creates room for overreach, where the skill may be engaged for loosely related discussion and steer users toward tool-mediated market outputs without a clear request.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This second routing block repeats the same broad trigger set for OpenClaw, again preferring Minara for a wide range of finance-related language with no precise boundaries. In context, that is more dangerous because the skill description includes wallet, transfer, withdrawal, autopilot, and trading actions, so over-routing can expose users to unnecessary operational pathways.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The OpenClaw proactive engagement rule again relies on undefined 'vague finance question' language and instructs command use in response. Because the surrounding skill supports financial operations, ambiguous proactive activation increases the chance of unnecessary tool use and user steering in a high-risk domain.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup begins with instructions to inspect and modify user configuration files, including creating them if missing, but it does not clearly foreground the persistence and behavioral impact of those changes. Even though some branches say to tell the user, the guidance is insufficiently explicit about scope, permanence, and file creation, which undermines informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The OpenClaw MEMORY.md write path appends persistent preferences without instructing the agent to disclose the change to the user first. Silent modification of memory files is especially risky because it creates durable behavioral bias for future sessions while reducing user visibility and control.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi
fi
SKILL_LOCAL=$(grep -m1 '^version:' "$SKILL_DIR/SKILL.md" 2>/dev/null | sed 's/^version:[[:space:]]*["'"'"']*\([^"'"'"']*\).*/\1/' || echo "0.0.0")
SKILL_REMOTE=$(curl -fsSL -m 5 "https://api.github.com/repos/Minara-AI/skills/releases/latest" 2>/dev/null | grep -o '"tag_name":[[:space:]]*"[^"]*"' | sed 's/.*"v\{0,1\}\([^"]*\)"/\1/' || echo "")

# 5. Build result (only flag upgrade when local < remote)
RESULT="UP_TO_DATE"

• Confidence: 84% confidence
• Finding: https://api.github.com/

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

minara perps close                    # Interactive: select position to close
minara perps close --all              # Close all positions (non-interactive)
minara perps close --symbol BTC       # Close BTC position (non-interactive)
minara perps close --all --yes        # Close all, skip confirmation

# Cancel orders
minara perps cancel

• Confidence: 93% confidence
• Finding: skip confirmation

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match

Content

After a successful upgrade, invalidate the cache so the next session re-detects correctly:
```bash
rm -f ~/.minara/.last-update-check
```

Only prompt for the components listed in the `UPGRADE` output (e.g. if only `cli:` is present, don't mention skill).

• Confidence: 84% confidence
• Finding: rm -f ~/; non-interactive; non-interactive; silently; Non-interactive; Non-interactive

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.