ClawHub
Back to skill

Security audit

Virtuals

Security checks across malware telemetry and agentic risk

Overview

This crypto skill is not clearly malicious, but it asks users to store a raw wallet private key locally with misleading safety wording and unclear mainnet/testnet behavior.

Review before installing. Do not enter a real or funded wallet private key. If you test it, use a disposable wallet with minimal funds, assume ~/.openclaw/virtuals/config.json contains a recoverable secret, and verify the network yourself because the code uses Base mainnet despite the testnet-only warning.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (14)

Lp3

Medium
Category
MCP Least Privilege
Confidence
76% confidence
Finding
The documentation indicates environment/config capabilities but does not declare corresponding permissions, which weakens transparency and permission review for a skill that handles wallets and trading actions. In a financial/blockchain context, undeclared capability to access environment-backed secrets or local configuration increases the risk of hidden credential use or unexpected side effects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill claims to integrate with Virtuals Protocol, but the documented/observed behavior extends to local storage of wallet credentials, third-party API calls, and arbitrary address balance lookups without making those behaviors explicit in the high-level description. For a crypto-trading skill, incomplete disclosure is dangerous because users may expose private keys, on-chain activity, and wallet data without understanding where information is stored or sent.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill accepts and stores a raw private key in a local JSON config file, despite not performing any signed transactions that require such a secret. Retaining unnecessary wallet secrets materially increases the blast radius of local compromise, accidental disclosure, backup leakage, or later feature expansion that reuses the stored key unsafely.

Intent-Code Divergence

Medium
Confidence
99% confidence
Finding
The CLI claims the private key is 'stored securely' while persisting it in plaintext JSON on disk. Even with file mode 0600, local compromise, backups, shell history exposure, malware, or accidental file disclosure can reveal the key and lead to wallet takeover and irreversible asset loss.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to pass a private key directly via command-line configuration without clear secure-handling guidance. Private keys entered on the CLI can be exposed through shell history, process inspection, logs, or insecure local storage, which can lead to irreversible theft of funds or control of blockchain accounts.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
Passing a private key via a command-line option exposes it to shell history, process listings, audit logs, and possibly crash reports before it is even written to disk. In the context of a crypto-related skill, disclosure of the private key would enable full theft of wallet assets and impersonation of the user onchain.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
Accepting a private key as a CLI option is dangerous because command-line arguments are often exposed through shell history, process listings, logs, telemetry, and CI job output, and this code then writes the secret to disk as well. In a wallet-integrated skill, that creates a direct path to credential theft and unauthorized blockchain transactions.

Session Persistence

Medium
Category
Rogue Agent
Content
- 📊 **List agents** - Browse top AI agents on Virtuals
- 💰 **Check prices** - Get agent token prices and market data
- 🔍 **Agent details** - View agent info, holders, transactions
- 🚀 **Create agent** - Launch your own tokenized AI agent
- 💸 **Trade** - Buy/sell agent tokens

## Installation
Confidence
63% confidence
Finding
Create agent** - Launch your own tokenized AI agent - 💸 **Trade** - Buy/sell agent tokens ## Installation ```bash clawhub install virtuals cd ~/.openclaw

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "IntechChain",
  "license": "MIT",
  "dependencies": {
    "commander": "^12.1.0",
    "ethers": "^6.9.0",
    "axios": "^1.6.0"
  },
Confidence
94% confidence
Finding
"commander": "^12.1.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "commander": "^12.1.0",
    "ethers": "^6.9.0",
    "axios": "^1.6.0"
  },
  "devDependencies": {
Confidence
94% confidence
Finding
"ethers": "^6.9.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "commander": "^12.1.0",
    "ethers": "^6.9.0",
    "axios": "^1.6.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
Confidence
98% confidence
Finding
"axios": "^1.6.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"axios": "^1.6.0"
  },
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  }
}
Confidence
86% confidence
Finding
"@types/node": "^20.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  }
}
Confidence
88% confidence
Finding
"typescript": "^5.0.0"

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
axios==1.6.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
dist/cli.js:49

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/cli.ts:13

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
dist/cli.js:270

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
src/cli.ts:271