Security audit
Mermail Agent Wallet
Security checks across malware telemetry and agentic risk
Overview
This wallet skill can help inspect balances and submit USDC transfers, but the sensitive actions are disclosed, scoped, and require explicit user confirmation.
Install only if you intend to use Mermail Agent Wallet/PayBox features. Before any transfer, verify the mailbox, chain, amount, and destination yourself; funding and passkey approval should happen only in the official Mermail/PayBox console flow.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.