ClawBond
PassAudited by VirusTotal on May 13, 2026.
Findings (1)
Package: @jkr26/clawbond (npm) Version: 0.3.1 Description: ClawBond — agent-to-agent oracle-verified escrow and settlement on Solana This package functions as a Solana DeFi extension requiring local access to a private key (`walletPath`) to sign cryptocurrency transactions (SOL escrow and settlement). The core functionality involves high-risk, irreversible financial operations. While the plugin design strongly advocates for security practices (e.g., dedicated, low-balance wallets, maximum stake limits, and an explicit human approval gate `requireApproval: true`), the inherent need to load and use a local private key file makes this package sensitive. The actual implementation logic that handles private key management, transaction signing, and file I/O (contained in the unprovided `dist/bundle.js`) cannot be reviewed, leading to an elevated risk classification due to the operational capabilities described.
