Security audit

kaspa-wallet

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent Kaspa wallet skill, but it can directly sign and broadcast irreversible cryptocurrency transfers using wallet secrets without a clearly documented confirmation or dry-run safeguard.

Install only if you are comfortable with an agent-accessible wallet tool. Use a test wallet first, avoid storing valuable private keys or mnemonics in long-lived environment variables, verify every recipient address, amount, network, and fee manually, and do not allow automated sends unless the tool adds an explicit confirmation or dry-run step.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly requires shell execution and access to sensitive environment variables, yet it declares no permissions. This creates a trust and review gap: an agent or user may authorize the skill without understanding that it can read wallet secrets and invoke installation or wallet commands, increasing the chance of unintended credential exposure or risky execution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 84% confidence
Finding: The stated purpose understates several sensitive behaviors, including dependency installation from PyPI, network/RPC interaction, fee estimation, URI generation, and mnemonic generation. In a cryptocurrency context, behavior mismatches are especially risky because users may grant trust for a simple wallet utility while the skill also performs software installation and handles high-value secrets and payment operations.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README presents a live cryptocurrency transfer command without warning that blockchain transactions are irreversible or that users must carefully verify the destination address and amount before sending. In an agent-oriented skill, this is more dangerous because automated or hurried execution can lead to permanent loss of funds from typos, prompt injection into parameters, or misuse of the `max` option.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README instructs users to place a private key in an environment variable without any warning that environment variables can be exposed through shell history, process listings, logs, CI systems, crash reports, or inherited subprocesses. Because this skill is a wallet tool intended for automated agents, encouraging direct use of highly sensitive secrets in the environment materially increases the risk of full wallet compromise and theft.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README advertises mnemonic generation without warning that the generated seed phrase grants complete access to wallet funds and must be backed up securely offline. In the context of a cryptocurrency wallet skill, omission of this warning can cause users or agents to display, store, or transmit the mnemonic insecurely, leading to irreversible asset theft.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill provides commands to send cryptocurrency, including sending the entire balance, without a prominent warning that blockchain transfers are irreversible and can permanently destroy funds if the address or amount is wrong. In a wallet skill, this omission materially increases the chance of user harm because an agent may automate a destructive action with no confirmation or safety language.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs users to place a private key or mnemonic into environment variables without clearly warning that these values are highly sensitive and may be exposed through shell history, process inspection, CI logs, crash reports, or inherited subprocess environments. Because these credentials control cryptocurrency funds, accidental disclosure can directly lead to wallet compromise and theft.

Missing User Warnings

Medium

Confidence: 78% confidence
Finding: The skill directly consumes wallet secrets from environment variables, which is sensitive in an agent/tooling context because secrets may be broadly available to subprocesses, logs, crash reports, or adjacent tooling. In a cryptocurrency wallet skill, this materially increases the blast radius: if the environment is exposed, an attacker can sign transactions and drain funds.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The send command signs and submits blockchain transactions immediately, without any confirmation prompt, dry-run default, recipient verification step, or explicit irreversible-action warning. In an agent skill, this is especially dangerous because a mistaken prompt, prompt injection, or ambiguous instruction could trigger a real transfer of cryptocurrency that cannot be reversed.

Unpinned Dependencies

Low

Category: Supply Chain
Content: kaspa
Confidence: 95% confidence
Finding: kaspa

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.