Sally AI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:31 PM UTC
• Version: 1.0.4

Overview

This skill is mostly purpose-aligned, but it asks users to place a wallet private key in a command-line connection string and forwards health-related messages to external services.

Review this carefully before installing. Use only a dedicated low-balance wallet, rotate any key previously pasted into the setup command if it may be in shell history, and avoid sending names, dates of birth, medical record identifiers, or other unnecessary personal health details in questions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:29

Finding

Wallet Private Key Exposed Through Command-Line Arguments and Third-Party Transfer

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-43
Vulnerability Type: Wallet credential exposure through command-line arguments and external secret custody
Risk Level: High

Vulnerable Code Snippet:

markdown

### Step 1: Login to Smithery
```bash
smithery auth login

Step 2: Add Sally AI MCP connection

bash

smithery mcp add "sally-labs/sally-ai-mcp?privateKey=0xYOUR_PRIVATE_KEY" \
  --id sally-ai \
  --force

Replace 0xYOUR_PRIVATE_KEY with your dedicated wallet's private key (must include 0x prefix).

Security Note: Your private key is stored encrypted in Smithery's cloud, NOT on your local machine. Clawbot communicates with Smithery's API but never accesses your private key.

text

### Technical Analysis

The setup procedure requires users to place a wallet private key directly inside a command-line argument and URL-style connection string. Secrets supplied this way can be exposed through shell history, terminal logs, process inspection, command auditing, diagnostic output, or CLI error reporting.

The command also transfers the key to Smithery for cloud storage and transaction signing. Encryption at rest does not eliminate the risks introduced while the key is entered, transmitted, processed, or accessed for signing. The statement that Clawbot does not access the key does not protect it from local command-line exposure or compromise of the third-party custody environment.

### Attack Path

1. A user replaces `0xYOUR_PRIVATE_KEY` with a real wallet private key.
2. The shell records the complete command in command history, or the argument is exposed through process-monitoring or audit facilities.
3. The Smithery CLI receives and transmits the private key to an external cloud service.
4. An attacker with access to local history, telemetry, logs, process information, or the remote account or service obtains the key.
5. The attacker imports the key into anot
...[truncated 479 chars]

Remediation

View remediation

Remediation Suggestions

• Do not accept private keys through URLs, connection strings, command-line arguments, environment variables, or configuration files.
• Prefer local transaction signing with a wallet application, hardware wallet, or operating-system-backed secure key store.
• If remote custody is unavoidable, use an interactive secret-entry mechanism that disables terminal echo and prevents shell-history storage.
• Use a narrowly scoped delegated or session key instead of a wallet's primary private key.
• Enforce transaction-level spending limits, destination restrictions, expiration, and explicit user approval.
• Document the key-processing lifecycle, encryption controls, access policies, retention period, recovery process, and incident-response procedure.
• Instruct existing users to remove affected commands from shell history and rotate any key previously entered through this mechanism.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Installation of the Latest Smithery CLI Release

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-19
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml

"openclaw":
  {
    "emoji": "🩺",
    "requires": { "bins": ["smithery"] },
    "install":
      [
        {
          "id": "node",
          "kind": "node",
          "formula": "@smithery/cli@latest",
          "bins": ["smithery"],
          "label": "Install Smithery CLI (npm)",
        },
      ],
  },

Technical Analysis

The installation metadata resolves @smithery/cli@latest at installation time rather than selecting a reviewed, immutable release. Consequently, the code installed in the future can differ from the version assessed when the Skill was published.

A compromised maintainer account, malicious package update, registry compromise, or unexpectedly vulnerable release could cause attacker-controlled package code to run during installation or later CLI invocation. The documentation does not specify a version pin, package integrity value, lockfile, or trusted artifact digest.

Attack Path

1. An attacker compromises the package publication process, maintainer credentials, or registry distribution path.
2. The attacker publishes a malicious release under the legitimate package name and causes it to become the latest version.
3. A user installs the Skill after that release is published.
4. The installer resolves @smithery/cli@latest to the malicious version.
5. Malicious package lifecycle code or CLI behavior executes with the installing user's privileges.
6. The code can access data and credentials available to that user, subject to operating-system controls.

Impact Assessment

Exploitation can provide arbitrary code execution with the privileges of the user performing installation or invoking the CLI. Depending on the environment, this can expose local files, authentication token ...[truncated 160 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @smithery/cli@latest with an exact, security-reviewed version.
• Verify the package artifact using an integrity hash or equivalent immutable provenance mechanism.
• Use a lockfile where supported and retain reviewed dependency metadata with the project.
• Review release notes and source changes before updating the pinned version.
• Run dependency installation and execution with least privilege in an isolated environment.
• Disable package lifecycle scripts where they are unnecessary and supported by the installation workflow.
• Add automated dependency and provenance scanning without automatically adopting newly published versions.

other

Warning

• Location: SKILL.md:47

Finding

Potentially Sensitive Health Messages Are Forwarded Verbatim to External Services

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47-51; additional data-flow disclosure at lines 93-97
Vulnerability Type: Sensitive health-data disclosure
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Quick Start

Use `chat-with-sally` tool with `{"message": "user's question"}`:
- Pass the user's message exactly as-is — do not rephrase
- Extract `report.message` from the JSON response and present it to the user
- Preserve any citations Sally includes

markdown

### Data Flow

- User messages sent to Sally's backend (api-x402.asksally.xyz) via Smithery MCP
- Sally processes questions and returns responses with citations
- No personal health data collected or stored (knowledge-focused mode)
- Each interaction logged on-chain (Base network) as transparent payment record

Technical Analysis

The Skill instructs the agent to forward user messages exactly as written to Sally's backend through Smithery. Because the documented scope includes laboratory results, blood sugar, A1C, nutrition, supplements, and related medical topics, messages can contain sensitive health information or direct identifiers.

The instruction does not require consent, identifier redaction, data minimization, or detection of accidental secret disclosure. The statement that personal health data is not collected or stored does not prevent the remote systems from receiving and processing such information, and the project contains no technical controls demonstrating or enforcing the stated retention behavior.

Attack Path

1. A user asks a health-related question containing laboratory values, medical history, contact information, or another identifier.
2. The agent follows the instruction to pass the message exactly as written.
3. Smithery and Sally's backend receive and process the complete message.
4. The information may become exposed through service logs, monitoring systems, support too ...[truncated 652 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain explicit, informed user consent before transmitting health-related content to external services.
• Clearly identify every processor, the destination service, intended use, retention policy, and applicable privacy controls before submission.
• Remove the requirement to forward messages exactly as written.
• Redact names, dates of birth, addresses, account identifiers, medical-record identifiers, and other unnecessary identifying details by default.
• Warn users not to submit protected health information, credentials, wallet secrets, or other unnecessary sensitive data.
• Apply data minimization so only the portion required to answer the question is transmitted.
• Provide a local confirmation showing the exact text and destination before transmission.
• Validate claims about non-collection and non-retention through enforceable service configuration, contracts, and independent technical assessment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep