Agent Wallet

PassAudited by VirusTotal on May 13, 2026.

Findings (1)

Package: @agentlayertech/agent-wallet-plugin (npm) Version: 0.1.15 Description: OpenClaw plugin bridge for the AgentLayer wallet runtime. This package is an OpenClaw extension designed to act as a bridge between the OpenClaw agent runtime (Node.js/TypeScript) and an external Python wallet management backend (`agent-wallet`). It defines numerous tools for multi-chain (Solana, EVM, Bitcoin) wallet operations, including balance lookups, transfers, swaps, and DeFi actions (Jupiter, Kamino, Aave, Lido). The plugin uses `node:child_process.execFile` to execute the Python backend CLI. Crucially, the implementation enforces robust security practices for high-risk operations: all state-mutating actions require a mandatory 'preview' mode followed by an 'execute' mode, which must be accompanied by a host-issued `approval_token`. This token is cryptographically bound (via SHA-256 digest) to the exact operation parameters confirmed during the preview stage, preventing unauthorized or modified execution. While it executes external code, this mechanism is central to the plugin's function and is implemented with explicit controls to minimize risk.