Kaspa Wallet
Security checks across malware telemetry and agentic risk
Overview
This appears to be a real Kaspa wallet, but it asks for full wallet-spending secrets and exposes irreversible send/max-balance commands without declared credentials or a clear confirmation gate.
Use this only with a small, dedicated Kaspa wallet or testnet wallet unless you fully trust the code and dependency. Do not let an agent send KAS autonomously; confirm the recipient, amount, network, and fees yourself, and avoid exposing your primary wallet seed phrase.
VirusTotal
66/66 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent using this skill could send cryptocurrency, including the full balance, and blockchain transfers are not reversible.
The skill documents a command that can transfer the entire wallet balance, and the surrounding agent examples do not specify an explicit user confirmation requirement before sending funds.
./kaswallet.sh send <address> max # Send entire balance
Require the agent to ask for explicit user approval for every send, including recipient, amount, fee tier, network, and any `max` transaction; consider adding a dry-run or confirmation workflow.
A user may not realize from the registry entry that installing and using the skill requires exposing full wallet credentials to the local agent process.
The registry metadata does not declare credentials, but the skill requires a private key or seed phrase that grants wallet-spending authority.
metadata: "Required env vars: none" / "Primary credential: none"; SKILL.md: "export KASPA_PRIVATE_KEY=\"64-character-hex-string\" # OR export KASPA_MNEMONIC=\"your twelve or twenty four word seed phrase\""
Declare the required credential/env vars in metadata, warn users that these secrets can spend funds, and recommend using a dedicated low-balance wallet rather than a primary wallet.
A dependency change or compromised package could affect a wallet that handles private keys and sends transactions.
The dependency is unpinned; install.py installs requirements via pip, so the wallet's private-key handling depends on whatever `kaspa` package version is resolved at install time.
kaspa
Pin and verify dependency versions or review the installed package before using this skill with real funds.