Security audit

Portal Wallet

Security checks for vulnerabilities and agentic risk

Overview

This is a clearly disclosed Portal crypto-wallet skill with real fund-transfer and signing power, but the high-risk behavior matches its stated purpose and includes meaningful safety guidance.

Install only if you intend to let an agent operate a Portal crypto wallet. Use test funds first, configure the signature-approval webhook and spending limits before holding meaningful balances, keep the Portal API key and MPC shares out of source control, and manually review every transaction or signature request before approval.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The skill explicitly warns not to sign user- or externally-supplied hashes, yet later documents a raw signing endpoint that accepts an arbitrary digest. In a wallet skill, exposing raw signing materially increases the risk that an agent could authorize opaque payloads, off-protocol approvals, or signatures that users cannot meaningfully review.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README advertises high-risk wallet capabilities such as sending tokens, signing transactions, and swapping assets without clearly warning that these actions can irreversibly move funds or approve malicious transactions. In an agent-integrated crypto wallet skill, this omission increases the chance that operators deploy or use the skill without appropriate human approval expectations and transaction-risk awareness.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg to "<recipient-address>" \ --arg amount "<amount>" \ '{share: $share, chain: "monad", to: $to, token: "NATIVE", amount: $amount, rpcUrl: "https://api.portalhq.io/rpc/v1/eip155/143"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/assets/send' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 90% confidence
Finding: This example transmits an MPC share to a remote signing service as part of a funds-transfer operation. Although this is core to the product design, the skill context is highly sensitive because it can move real cryptocurrency; any misuse, prompt-injection-driven invocation, or insufficient confirmation could directly result in asset loss.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg to "<recipient-address>" \ --arg amount "<amount>" \ '{share: $share, chain: "solana-devnet", to: $to, token: "NATIVE", amount: $amount, rpcUrl: "https://api.portalhq.io/rpc/v1/solana/EtWTRABZaYq6iMfeYKouRu166VU2xqa1"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/assets/send' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 89% confidence
Finding: This Solana send example also sends sensitive signing material in support of broadcasting a real asset transfer. In a wallet skill, remote transmission tied to signing is inherently dangerous because a compromised agent flow or ambiguous user intent could trigger unauthorized movement of funds.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg to "<recipient-address>" \ --arg amount "<amount>" \ '{share: $share, chain: "bitcoin-segwit-testnet", to: $to, token: "NATIVE", amount: $amount}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/assets/send' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 89% confidence
Finding: The Bitcoin send example enables real fund transfer through an external API using sensitive signing input. Because blockchain transfers are generally irreversible, any agent mistake, injection, or malformed destination handling could cause immediate financial loss.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg token "USDC" \ --arg amount "10" \ '{share: $share, chain: "monad", to: $to, token: $token, amount: $amount, rpcUrl: "https://api.portalhq.io/rpc/v1/eip155/143"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/assets/send' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 90% confidence
Finding: This token-transfer example enables ERC-20/SPL-like asset movement via a remote signing flow. In the context of a wallet skill, this is not a false alarm because the action can directly drain user-controlled tokens if triggered without robust confirmation and policy checks.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_SECP256K1_SHARE" \ --arg params "$TX_PARAMS" \ '{share: $share, method: "eth_sendTransaction", params: $params, rpcUrl: "https://api.portalhq.io/rpc/v1/eip155/143", chainId: "eip155:143"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/sign' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 92% confidence
Finding: The advanced eth_sendTransaction signing example gives low-level control over transaction parameters, which increases abuse potential beyond simple transfers. Attackers could use arbitrary calldata to invoke approvals, contract interactions, or value transfers that are difficult for users to understand without decoding and simulation.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_SECP256K1_SHARE" \ --arg params "<hex-encoded-message>" \ '{share: $share, method: "personal_sign", params: $params, chainId: "eip155:143"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/sign' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 94% confidence
Finding: personal_sign can be used to authorize off-chain actions, login challenges, permits, or deceptive messages that appear harmless in hex form. In a wallet skill, signing opaque messages is dangerous because users may not understand the downstream authority they are granting.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_SECP256K1_SHARE" \ --arg params "<stringified-typed-data-json>" \ '{share: $share, method: "eth_signTypedData_v4", params: $params, chainId: "eip155:143"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/sign' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 95% confidence
Finding: eth_signTypedData_v4 is especially sensitive because typed data commonly encodes token approvals, permits, delegated transfers, and marketplace authorizations. Even though the skill warns about this risk, the example still exposes a generic signing path that could be abused if the agent does not fully parse and explain the contents.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_ED25519_SHARE" \ --arg params "<base64-serialized-transaction>" \ '{share: $share, method: "sol_signAndConfirmTransaction", params: $params, chainId: "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp"}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/sign' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 88% confidence
Finding: The Solana sign-and-confirm example accepts a serialized transaction blob, which is effectively opaque unless decoded before signing. In a wallet context, this creates risk of signing arbitrary instructions that the user cannot review, potentially transferring assets or modifying account authorities.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_SECP256K1_SHARE" \ --arg params "<hex-digest-without-0x>" \ '{share: $share, params: $params}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/raw/sign/SECP256K1' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 98% confidence
Finding: This is the concrete raw-signing endpoint that contradicts the earlier safety rule against signing externally supplied hashes. Raw digest signing is especially dangerous because the user and agent cannot verify what semantic action the signature authorizes, making phishing and misuse substantially easier.

External Transmission

Medium

Category: Data Exfiltration
Content: --arg share "$PORTAL_SECP256K1_SHARE" \ --arg to "<recipient>" \ '{share: $share, chain: "monad", to: $to, token: "USDC", amount: "10", rpcUrl: "https://api.portalhq.io/rpc/v1/eip155/143", sponsorGas: false}' \ | curl -s -X POST 'https://mpc-client.portalhq.io/v1/assets/send' \ -H 'Content-Type: application/json' \ -H "Authorization: Bearer $PORTAL_CLIENT_API_KEY" \ --data @- | jq .
Confidence: 87% confidence
Finding: This send example again supports direct asset movement and includes parameters affecting who pays gas, which can obscure user cost expectations. In a financial skill, any executable transfer example is sensitive because misuse can lead to irreversible loss.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:26