ClawHub
Back to skill

Security audit

Vincent - A secure wallet for your agent

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill is coherent and not deceptive, but it gives agents broad financial authority with unsafe defaults and weak credential-handling guidance.

Install only if you are comfortable giving an agent transaction-capable wallet access. Claim the wallet before funding it, configure strict policies first, require approval for meaningful transactions, avoid raw signing or arbitrary calldata unless you fully understand the payload, and do not store API keys in a project directory or any location that could be committed, synced, logged, or shared.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:216
Finding

Wallet Bearer Credentials Are Persisted Without Mandatory Filesystem Protections

Content
View full analysis
.json`. Otherwise, you can store it in your current working directory at `agentwallet/.json`. ``` ```markdown - Always store the API key from wallet creation. If you're an openclaw instance, store it in `~/.openclaw/credentials/agentwallet/.json`. Otherwise, you can store it in your current working directory at `agentwallet/.json`. - Always search for the API keys in the credentials folder before using the API. If you're an openclaw instance, search for the API key in `~/.openclaw/credentials/agentwallet/.json`. Otherwise, you can search for the API key in your current working directory at `agentwallet/.json`. ``` ### Technical Analysis The API key is a bearer credential authorizing financially consequential wallet operations. The Skill directs the agent to persist this credential in a JSON file but does not require restrictive directory or file permissions, encryption at rest, use of an operating-system credential manager, log redaction, or protection against source-control inclusion. The fallback location under the current working directory is especially unsafe because it may be inside a repository, shared workspace, synchronized directory, build context, or backup set. A plaintext key could consequently be exposed through an accidental commit, artifact upload, permissive file mode, workspace sharing, or access by another local process. Searching the dedicated `agentwallet` directory is reasonably connected to credential retrieval and is not evidence of indiscriminate credential harvesting. The security ...[truncated 1165 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:176
Finding

New Wallets Permit Unrestricted Financial Operations Until Policies Are Configured

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:298
Finding

Balance Retrieval Unexpectedly Deploys a Wallet and Grants Token Approval

Content
View full analysis
" ``` Returns: - `walletAddress` -- the Safe address (deployed on first call if needed) - `collateral.balance` -- USDC.e balance available for trading - `collateral.allowance` -- approved amount for Polymarket contracts **Note:** The first balance call triggers Safe deployment and collateral approval (gasless via relayer). This may take 30-60 seconds. ``` ### Technical Analysis The nominally read-only `GET /balance` operation performs two state-changing actions: Safe deployment and collateral approval. This violates the expected safety and idempotency semantics of an HTTP `GET` request and combines account inspection with authorization of a token spender. Automated agents, monitoring systems, browsers, caches, or retry mechanisms may invoke or repeat a balance request under the assumption that it cannot alter blockchain state. Although the side effect is disclosed in the documentation, disclosure does not provide separate, affirmative consent to the spender, allowance amount, or deployment action. Token approval creates authority that can remain in place after the balance request. The exact spender and allowance scope are not shown in the audited documentation, so the report does not assume an unlimited allowance; however, any nonzero approval expands the trusted execution surface. ### Attack Path 1. A user or agent requests the Polymarket wallet balance, expecting a read-only operation. 2. The service deploys the Safe on the first request. 3. The service also submits a collateral approval for Polymarket contracts. 4. The approval remains active after the balance response. 5. If an approved spender or an associated integ ...[truncated 656 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to store bearer API keys on the local filesystem and later retrieve them for wallet operations. Because these keys authorize transfers, swaps, arbitrary contract calls, raw signing, and betting, local credential persistence materially expands the skill from transaction execution into secret handling and creates a theft/reuse risk if the host, workspace, logs, or other tools are compromised.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Create a new smart account wallet for your agent. This generates a private key server-side (you never see it), creates a ZeroDev smart account, and returns an API key for the agent plus a claim URL for the wallet owner.

bash
curl -X POST "https://heyvincent.ai/api/secrets" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "EVM_WALLET",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The arbitrary transaction feature allows sending custom calldata to any smart contract, which can approve token spending, transfer assets, interact with malicious contracts, or trigger irreversible state changes. Documenting this capability without a strong warning and without emphasizing selector/address restrictions is dangerous because users may treat it like a normal transfer rather than a full-power contract execution primitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that if no policies are set, all wallet actions are allowed by default, yet it does not foreground this as a critical risk before enabling transfers, swaps, contract calls, or betting. In the context of an agent wallet, permissive defaults mean a newly created or unclaimed wallet can be used for broad financial actions without clear user understanding of the exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

  1. The agent calls the re-link endpoint to exchange the token for a new API key
bash
curl -X POST "https://heyvincent.ai/api/secrets/relink" \
  -H "Content-Type: application/json" \
  -d '{
    "relinkToken": "<TOKEN_FROM_USER>",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Telling the agent to search credential directories for API keys is an unnecessary credential-discovery behavior that can lead to overbroad access to unrelated wallet secrets present on the machine. In this skill, any discovered key can unlock high-risk financial actions, so this effectively encourages lateral secret access beyond the user's immediate request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Raw signing is one of the highest-risk wallet capabilities because signatures over untrusted payloads can authorize asset transfers, off-chain orders, permits, login sessions, or transaction broadcasts that bypass smart-account policy controls. The skill presents raw ECDSA/Ed25519 signing as an advanced feature but lacks a strong warning that the agent must never sign opaque or user-supplied payloads without trusted decoding and explicit approval.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

Create a Polymarket Wallet

bash
curl -X POST "https://heyvincent.ai/api/secrets" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "POLYMARKET_WALLET",

Static analysis

No suspicious patterns detected.