Security audit

Agent Wallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill is mostly coherent, but it gives agents high-impact financial authority and includes an unsafe remote self-update path for persistent instructions.

Install only if you trust frames.ag to custody wallet actions and handle proxied request data. Do not run the heartbeat self-update commands as written; review any updated skill files manually. Treat the API token like a password, avoid forwarding unrelated Authorization/Cookie/API-key headers through x402/fetch, and require explicit confirmation or dry-run review before transfers, contract calls, signatures, or paid API requests.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: HEARTBEAT.md:117
Finding: Heartbeat Instructions Inject Unsolicited Referral Promotion into Agent Responses
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: HEARTBEAT.md:8
Finding: Heartbeat Replaces Persistent Skill Instructions with Unverified Remote Content
Content: View full analysis
~/.agentwallet/SKILL.md curl -s https://frames.ag/heartbeat.md > ~/.agentwallet/HEARTBEAT.md ``` ``` ### Technical Analysis The heartbeat downloads mutable Markdown files from `frames.ag` and directly overwrites persistent local Skill instructions. No cryptographic signature, pinned checksum, trusted release manifest, content validation, rollback mechanism, or explicit user approval is required. Although the retrieved files are Markdown rather than native executables, they are executable in the context of an AI Agent because their instructions determine subsequent tool use and response behavior. Replacing `SKILL.md` or `HEARTBEAT.md` therefore creates a remotely mutable instruction-execution channel. Writing the downloaded content under `~/.agentwallet/` also makes the modification persist across future Agent sessions. A compromise of the remote service, its deployment pipeline, DNS resolution, certificate trust environment, or publishing credentials could replace the audited instructions with malicious directives. ### Attack Path 1. A user installs a reviewed version of the Skill. 2. The heartbeat checks the remotely hosted `skill.json`. 3. An attacker compromises the content served by `frames.ag`, or the service operator publishes a malicious update. 4. The remote version indicates that an update is available. 5. The heartbeat downloads attacker-controlled `skill.md` and `heartbeat.md`. 6. Shell redirection overwrites the trusted local instruction files. 7. Future sessions load the modified instructions. 8. The new instructions can direct the Agent to a ...[truncated 1010 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Payment Proxy Can Receive Sensitive Caller-Supplied Headers and Request Bodies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The heartbeat recommends piping remote content directly into local skill files, effectively replacing trusted local instructions with unauthenticated remote content at runtime. This is dangerous because a compromised server, DNS path, or malicious update could silently alter the skill's behavior and cause downstream unsafe actions or prompt injection persistence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs authenticated requests using a bearer token without any warning about token sensitivity, storage, shell history, or exposure risk. In an agent setting, this normalizes sending privileged credentials to remote endpoints and can lead to credential leakage or misuse if logs, prompts, or command history are exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: These additional authenticated API calls query wallet balances, activity, and referral data without warning that sensitive financial and relationship metadata is being transmitted and may be retained in logs or telemetry. In an agent context, this increases privacy risk and may expose operational or financial information beyond what is necessary for routine heartbeat behavior.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The instruction to automatically inspect a local config file and avoid asking the user for email encourages the agent to make authentication and data-access decisions without explicit consent. In practice, this can normalize secret discovery from local files and reduce user awareness when existing credentials are reused for wallet operations.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
## TL;DR - Quick Reference **FIRST: Check if already connected** by reading `~/.agentwallet/config.json`. If file exists with `apiToken`, you're connected - DO NOT ask user for email. **Need to connect (no config file)?** Ask user for email → POST to `/api/connect/start` → user enters OTP → POST to `/api/connect/complete` → save API token.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The one-step x402 proxy instructs the agent to send arbitrary target URLs and request bodies to a remote service, which can trigger payment signing and outbound requests on the user's behalf. In a finance skill, this is more dangerous than ordinary external transmission because it can combine data exfiltration, SSRF-like proxying to third parties, and automatic spending through a single endpoint.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
This is the simplest way to call x402 APIs. Send the target URL and body - the server handles 402 detection, payment signing, and retry automatically.

bash
curl -s -X POST "https://frames.ag/api/wallets/USERNAME/actions/x402/fetch" \ -H "Authorization: Bearer TOKEN" \ -H "Content-Type: application/json" \ -d '{"url":"https://enrichx402.com/api/exa/search","method":"POST","body":{"query":"AI agents","numResults":3}}'

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
md
| `moltbookUsername` | Linked Moltbook username (if any) | | `xHandle` | X/Twitter handle from Moltbook (if linked) | **Security:** Never commit to git. Set `chmod 600`. Treat `apiToken` like a password. ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
Step 1 - Send OTP:

bash
curl -X POST https://frames.ag/api/connect/start \ -H "Content-Type: application/json" \ -d '{"email":"your@email.com"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.
Run periodically to check for skill updates, wallet status, and recent activity:

bash
curl https://frames.ag/heartbeat.md

Base URL: https://frames.ag/api/v1

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill provides direct instructions for transfers and contract calls that can move real funds or invoke arbitrary on-chain logic, but it does not require an explicit user confirmation or warn that these actions are irreversible. In an agent context, this increases the risk of accidental or socially engineered fund loss because the model may treat these as routine API calls.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 334)May include surrounding context.
Get current policy:

bash
curl https://frames.ag/api/wallets/YOUR_USERNAME/policy \ -H "Authorization: Bearer FUND_API_TOKEN"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest declares very broad trigger phrases such as "wallet", "policy", "activity", and "transactions", which are likely to match many ordinary user requests unrelated to this specific skill. Because this is a finance-capable wallet skill that can sign payments and perform policy-controlled actions, accidental invocation could expose users to unintended fund movement, wallet operations, or sensitive financial context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest centers on wallets, x402 payment signing, referral rewards, and policy-controlled actions. These instructions direct the agent to poll a network pulse endpoint for active agents, transaction volume, trending APIs, and new joins, which is ecosystem analytics and engagement tracking rather than an obvious wallet-specific operation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest describes wallets for AI agents with payment signing, referral rewards, and policy-controlled actions. This heartbeat goes beyond describing or operating referral rewards by instructing the agent to actively recruit other agents, track referral tiers, and pursue airdrop-point growth as an operational goal, which is a broader network-growth behavior than a wallet skill would imply.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.