ChainWard

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:01 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent ChainWard wallet-monitoring helper, but users should understand it installs an external CLI and uses a ChainWard API key.

Install only if you trust ChainWard and are comfortable giving its CLI access to CHAINWARD_API_KEY. Review the npm package/version you install, keep the API key limited to ChainWard use, and check ~/.chainward/config.json and alert delivery channels for sensitive configuration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:4
• Finding: Unpinned External npm Package Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: { "openclaw": { "emoji": "🛡️", "requires": { "bins": ["chainward"], "env": ["CHAINWARD_API_KEY"] }, "primaryEnv": "CHAINWARD_API_KEY", "install": [{ "id": "chainward-npm", "kind": "node", "package": "@chainward/cli", "bins": ["chainward"], "label": "Install ChainWard CLI" }] } } ``` ### Technical Analysis The installation metadata specifies `@chainward/cli` without an exact version or integrity hash. Consequently, installation can resolve to a future package release whose implementation differs from the version originally reviewed. The dependency is an executable CLI and is expected to operate while `CHAINWARD_API_KEY` is available. Its source code is not included in the audited project, so this audit cannot verify its credential handling, network destinations, local configuration behavior, lifecycle scripts, or command implementation. This is a supply-chain weakness rather than evidence that the current external package is malicious. Exploitation would require compromise of the package publisher, npm distribution path, or a subsequently published release. ### Attack Path 1. An attacker compromises the npm publisher account or another component of the package publication process. 2. The attacker publishes a malicious version of `@chainward/cli`. 3. A user or Agent installs the Skill dependency without an exact version constraint or verified integrity value. 4. npm resolves the dependency to the attacker-controlled release. 5. Malicious package lifecycle code or CLI code executes with the permissions of the installing or invoking user. 6. The code may read `CHAINWARD_API_KEY` when exposed to the process, access Agent-readable local data, or transmit wallet-monitoring information to an attacker-controlled service. ### Impact Assessment Successful exploita ...[truncated 779 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `@chainward/cli` to an exact, reviewed version rather than allowing the installer to resolve an unspecified release. 2. Record and verify a cryptographic integrity hash for the approved package artifact. 3. Review the package source, bundled files, npm lifecycle scripts, and transitive dependencies before approval. 4. Disable npm lifecycle scripts during installation where compatible with the package's documented requirements. 5. Use a lockfile or trusted internal package mirror to make dependency resolution reproducible. 6. Run the CLI with least privilege and expose `CHAINWARD_API_KEY` only to commands that require it. 7. Ensure any credential-bearing configuration file has restrictive filesystem permissions and does not store secrets in plaintext unless explicitly required and documented. 8. Document the expected ChainWard API endpoints so unexpected outbound connections can be restricted or detected. 9. Establish a controlled update process that reviews each new CLI version before changing the pinned dependency. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

Shows all configured alert rules with agent, type, threshold, delivery channels, and status (active/paused).

### Create an alert

```bash
chainward alerts create

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.