ClawHub
Back to skill

Security audit

Sona Next-Gen Wallet

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local adapter for a SONA Solana wallet agent, with real wallet-control capabilities that users should enable only intentionally.

Install this only if you intend to let an agent access your SONA wallet through a local service. Keep the wallet in standard or assisted mode unless you deliberately want autonomous execution, protect SONA_TOKEN like a session credential, and review policy limits before using transfer, approve, chat, or god mode.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Get a session token

```bash
TOKEN=$(curl -s -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"you","password":"yourpass"}' | jq -r '.token')
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill exposes sensitive capabilities involving environment variables and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. In a wallet skill that can authenticate to a local agent and trigger transfers, this omission weakens least-privilege controls and makes it easier for an LLM runtime to grant broader capabilities than users expect.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes autonomous transfers, swaps, staking, approvals, and mode switching, but does not present a prominent user-facing warning that it can perform state-changing wallet actions. In the context of a financial wallet agent, this increases the chance that users invoke the skill without appreciating that it can move funds or alter authorization modes.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Get a session token

```bash
curl -s -c cookies.txt -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"your_user","password":"your_pass"}' | jq -r '.token'
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
// ── Helpers ───────────────────────────────────────────────────────────────────

function headers(withAuth = false): Record<string, string> {
  const h: Record<string, string> = { "Content-Type": "application/json" }
  if (withAuth && TOKEN) h["Cookie"] = `sona_session=${encodeURIComponent(TOKEN)}`
  return h
Confidence
75% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
// ── Helpers ───────────────────────────────────────────────────────────────────

function headers(withAuth = false): Record<string, string> {
  const h: Record<string, string> = { "Content-Type": "application/json" }
  if (withAuth && TOKEN) h["Cookie"] = `sona_session=${encodeURIComponent(TOKEN)}`
  return h
Confidence
75% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
// ── Helpers ───────────────────────────────────────────────────────────────────

function headers(withAuth = false): Record<string, string> {
  const h: Record<string, string> = { "Content-Type": "application/json" }
  if (withAuth && TOKEN) h["Cookie"] = `sona_session=${encodeURIComponent(TOKEN)}`
  return h
Confidence
75% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The chat tool forwards arbitrary natural-language input directly to an authenticated autonomous wallet agent that can reason, plan, and execute state-changing actions, but it provides no execution-time warning, confirmation gate, or restriction in the tool itself. In this skill context, that is especially dangerous because the same interface can trigger transfers, swaps, policy changes, or other wallet actions through ambiguous prompts, increasing the risk of prompt injection, accidental spend, or operator misunderstanding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
plugin.ts:30