Security audit

Agent Wallet

Security checks across malware telemetry and agentic risk

Overview

This wallet skill is understandable in purpose, but it needs review because it can spend funds, store wallet authority, silently run heartbeat-style checks, and replace its own instructions from a remote website without integrity checks.

Install only if you are comfortable letting frames.ag provide server-side wallet and payment authority. Before use, set strict spending policies, require dryRun plus explicit approval before any paid call, transfer, contract call, or signing action, protect and rotate the ~/.agentwallet/config.json token, narrow activation triggers where possible, and avoid the heartbeat self-update commands unless the fetched files are independently reviewed and verified.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The heartbeat includes instructions focused on growth, rankings, referrals, and airdrop engagement rather than core wallet operation. In an agent context, this can manipulate agent behavior toward promotional or platform-growth objectives that are outside the declared wallet function, increasing the risk of unauthorized persuasion, unnecessary external calls, and misaligned actions on behalf of the user.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file instructs the agent to fetch and overwrite local skill files directly from a remote endpoint using curl, with no integrity verification, signature check, pinning, or approval step. This creates a supply-chain and remote-content-replacement risk where anyone controlling or intercepting that endpoint could change the skill's future behavior, including introducing malicious instructions or data exfiltration steps.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The markdown directs use of an authorization bearer token in HTTP requests without warning about secret handling, storage, logging, or scope minimization. In agent environments, such examples can normalize unsafe token usage, increasing the chance that credentials are exposed through shell history, logs, screenshots, prompt leakage, or misuse against unintended endpoints.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions tell the agent to overwrite local skill files with content fetched from the network, but provide no warning about authenticity, integrity, rollback, or trust boundaries. This is especially dangerous in a skill file because the replacement content can directly alter later agent behavior, effectively turning a documentation fetch into unverified code or instruction update.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill exposes transfer, contract-call, and signing operations that can move funds or authorize on-chain actions, but it does not clearly require explicit user confirmation or warn that blockchain actions are irreversible. In an agent setting, this increases the risk that the model will execute high-impact wallet actions from ambiguous or indirect prompts, causing permanent asset loss or unintended approvals.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The one-step x402/fetch flow is advertised as the recommended path and says the server handles payment signing and retry automatically, but it lacks a strong warning that ordinary API requests may trigger real paid transactions. In practice, an agent could treat this as a normal fetch helper and unintentionally spend wallet funds when accessing payment-gated endpoints.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The trigger list includes very broad terms such as "wallet", "policy", and "activity" that can match many benign user requests unrelated to this specific skill. In a finance-capable skill that can set up wallets, sign x402 payments, and send funds, unintended activation materially increases the chance of the wrong skill handling a request and initiating sensitive actions or exposing wallet-related context.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.