Use Developer Controlled Wallets

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:15 AM UTC
• Version: 0.1.0

Overview

The skill is purpose-aligned for Circle developer-controlled wallets, but its examples include unsafe handling for sensitive wallet recovery material and value-moving requests.

Review carefully before installing or relying on these snippets in production. The skill is not deceptive, but it handles custody credentials and can move funds; remove recovery-file logging, add idempotency keys to all mutating calls, require human approval for every transfer, and narrow activation to explicit Circle developer-controlled wallet requests.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: references/register-secret.md:17

Finding

Sensitive Wallet Recovery Material Is Exposed Through Console Logging

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/check-balance-and-transfer-tokens.md:23

Finding

Mutating Wallet and Transfer Examples Omit Required Idempotency Keys

Content

View full analysis

", }); const wallets = walletsResponse.data?.wallets ?? []; const sourceWallet = wallets[0]; const destinationWallet = wallets[1]; ``` The alternate wallet-creation example has the same omission: ```ts const solWalletResponse = await circleDeveloperSdk.createWallets({ accountType: "EOA", blockchains: ["SOL-DEVNET"], count: 1, walletSetId: "", }); ``` The token-ID transfer example omits an idempotency key: ```ts const transferResponse = await circleDeveloperSdk.createTransaction({ walletId: "", tokenId: "", destinationAddress: "", amounts: ["0.01"], fee: { type: "level", config: { feeLevel: "MEDIUM" }, }, }); const transactionId = transferResponse.data?.id; ``` The token-address transfer example also omits an idempotency key: ```ts const transferResponse = await circleDeveloperSdk.createTransaction({ walletId: "", tokenAddress: "", destinationAddress: "", amounts: ["0.01"], fee: { type: "level", config: { feeLeve ...[truncated 2214 chars]

Remediation

View remediation

", tokenId: "", destinationAddress: "", amounts: ["0.01"], fee: { type: "level", config: { feeLevel: "MEDIUM" }, }, }); ``` The application must persist and reuse `idempotencyKey` if this request is retried. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger list is broad enough to match generic wallet-related requests such as 'create wallet' or 'check balance,' which may cause this high-privilege custody skill to activate when a less-privileged or different wallet flow was intended. In context, that increases the chance of routing users into developer-controlled custody actions unnecessarily, which can lead to inappropriate handling of sensitive wallet operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- ALWAYS store recovery files outside the repository root. NEVER commit them to version control.
- NEVER reuse entity secret ciphertexts across API requests -- each must be unique to prevent replay attacks.
- NEVER register an entity secret on behalf of the user -- they must generate, register, and store it themselves.
- ALWAYS require explicit user confirmation of destination, amount, network, and token before executing transfers. NEVER auto-execute fund movements on mainnet.
- ALWAYS warn when targeting mainnet or exceeding safety thresholds (e.g., >100 USDC).
- ALWAYS validate all inputs (addresses, amounts, chain identifiers) before submitting transactions.
- ALWAYS warn before interacting with unaudited or unknown contracts.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file provides ready-to-run instructions for creating outbound token transfers from developer-controlled wallets but does not include an explicit user warning, confirmation step, or guardrail around initiating value-moving transactions. In the context of a custody wallet skill, this increases the risk that an agent or integrator triggers irreversible transfers without clear operator awareness, recipient validation, or human approval.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.