ClawHub
Back to skill

Security audit

Sona Next-Gen Wallet

Security checks across malware telemetry and agentic risk

Overview

This is a coherent SONA wallet adapter, but it gives an agent authenticated control over irreversible wallet actions with limited confirmation inside the plugin.

Install only if you intentionally want an OpenClaw agent to control a SONA wallet. Use devnet or very small balances, keep SONA_API_URL on localhost, protect and rotate SONA_TOKEN, independently verify the SONA service and signer enforce the claimed limits, and avoid god mode or automated approvals unless you have separate transaction review and monitoring.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill declares required environment variables and clearly depends on networked interaction with a local wallet service, yet it does not declare corresponding permissions. That mismatch can undermine platform trust and permission review, causing users or orchestration systems to invoke a skill with more capability than its manifest transparently communicates.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README advertises authenticated state-changing wallet operations such as transfers, mode switching, chat-driven commands, and approval of pending actions, but it does not clearly warn that these actions can move funds or authorize irreversible blockchain transactions. In a wallet-agent context, missing safety warnings increases the risk of accidental misuse by users or downstream integrators who may expose these tools to prompts or automations without adequate confirmation controls.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The transfer_sol tool performs a wallet transfer by forwarding a natural-language command directly to the privileged /api/chat endpoint without any execution-time confirmation, explicit safety interlock, or local validation of recipient and amount. In this skill context, the tool exposes real asset movement from an autonomous wallet, so prompt injection, user misunderstanding, or accidental tool invocation could lead to immediate irreversible fund transfers.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
approve_action is a state-changing operation that authorizes queued actions for later execution, yet the tool executes immediately from a supplied cycle_id with no local confirmation or user-facing warning. Because this plugin controls an autonomous wallet agent, approving a queued action can indirectly trigger transfers, swaps, or other financial actions, making accidental or manipulated approval materially dangerous.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
plugin.ts:30