Bitcoin Wallet using Breez Spark SDK

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:30 AM UTC
• Version: 1.0.0

Overview

BreezClaw is a coherent Bitcoin wallet skill, but it asks users to install and build unverified remote code that would handle payments, API keys, and wallet secrets.

Review the BreezClaw repository and package scripts before installing, prefer a pinned audited commit or signed release, and only enable it in an environment where you are comfortable exposing a Breez API key and self-custodial wallet authority. Treat mnemonic backup and mainnet send capability as highly sensitive even though the skill documents confirmation steps.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unpinned Remote Plugin Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-23
Vulnerability Type: Mutable remote code retrieval and insecure dependency execution
Risk Level: High

Vulnerable Code

bash

# Clone plugin
cd ~/.openclaw/extensions
git clone https://github.com/onesandzeros-nz/BreezClaw.git breezclaw

# Install dependencies and build
cd breezclaw
npm install
npm run build

Technical Analysis

The installation procedure clones the repository's mutable default branch without pinning a reviewed commit or cryptographically verified release. It then executes npm install and npm run build.

Consequently, the code executed by users can change after this skill has been reviewed. A repository compromise, malicious upstream update, or unsafe dependency update could introduce attacker-controlled code. In addition, npm install can execute package lifecycle scripts, while npm run build executes commands defined by the downloaded repository.

The audited artifact contains no plugin source, lockfile, commit identifier, release checksum, or signature with which to verify the retrieved payload and dependencies.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or a dependency used by the plugin.
2. The attacker adds malicious code to the default branch, a dependency lifecycle script, or the repository's build command.
3. A user follows the documented installation procedure and clones the mutable repository state.
4. The user runs npm install or npm run build, causing attacker-controlled code to execute.
5. The payload runs with the installing user's privileges and can attempt to access that user's files and wallet-related resources.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user performing the installation. Within those privileges, malicious code could access the OpenClaw configuration a ...[truncated 515 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a specific, reviewed commit hash or a signed, immutable release rather than the default branch.
2. Publish expected checksums or signatures and require verification before installation or execution.
3. Commit a reviewed package lockfile and replace npm install with npm ci so dependency versions and integrity metadata are enforced.
4. Audit direct and transitive dependencies for compromised, typosquatted, or unmaintained packages.
5. Disable npm lifecycle scripts during dependency installation where feasible, for example with npm ci --ignore-scripts, and invoke only separately reviewed build steps.
6. Review the downloaded plugin's package.json, lifecycle scripts, build commands, and source code before executing them.
7. Perform installation and builds in a restricted environment without access to production wallet data, mnemonics, API keys, or unnecessary user files.
8. Document a trusted release and update process that requires review before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.