ClawHub
Back to skill

Security audit

Stellar Agent Wallet

Security checks across malware telemetry and agentic risk

Overview

This is a high-impact Stellar wallet skill, but its fund movement, secret handling, network use, and confirmations are clearly disclosed and purpose-aligned.

Install only for a dedicated low-balance hot wallet. Prefer --identity when available, keep .stellar-secret out of git and synced folders, prototype on testnet where supported, verify recipient, amount, asset, memo, and network before confirming, and avoid --yes or --max-auto on mainnet unless you have independently constrained the transaction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill declares no explicit permissions while the documentation clearly describes access to local secret files, outbound network calls, and shell execution of Node/tsx scripts. That mismatch can cause users or a hosting agent platform to underestimate the wallet’s real authority, which is especially dangerous because the skill can sign mainnet transactions and move funds.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The document presents conflicting guidance about which header x402 v2 uses for payment submission, first stating `X-Payment` and later saying v2 servers read a different header. In a payment skill, protocol ambiguity is security-relevant because implementers may send signed payment credentials to the wrong header, causing failed payments, retries, or compatibility workarounds that weaken validation.

Vague Triggers

Low
Confidence
86% confidence
Finding
The manifest describes a wallet skill with broad payment, swapping, bridging, and address-triggered behavior but does not clearly constrain when the skill should activate or what confirmations are required before high-impact actions. In an agent context, vague trigger scope increases the chance of unintended invocation for financial operations, which can lead to unauthorized or mistaken transactions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
This package advertises secret storage and high-impact financial operations such as wallet management, swaps, and cross-chain transfers, but the description omits any user-facing warning about fund movement, irreversible transactions, memo/address correctness, or secret-handling risk. In a wallet skill, missing warnings materially increases the likelihood of unsafe use, social-engineering success, and accidental loss of funds.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The paid example shows a runnable mainnet command using a funded identity but does not prominently warn that executing it will spend real funds. In an agent-wallet context, that omission increases the chance that users or downstream agents copy-paste the command and trigger unintended monetary loss.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger list includes broad phrases such as "i need usdc on <chain>" and "deposit to ethereum," which can match general wallet or funding intent rather than a clearly scoped bridge action. In an agent environment that can move real funds, ambiguous triggering raises the risk that this skill is invoked when the user intended balance checks, quotes, or another transfer flow, potentially leading to unintended cross-chain payment setup.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger list includes generic phrases such as "first time" and "get started," which can match many unrelated user intents and cause the wallet skill to activate outside a clear payment context. In a wallet skill, accidental invocation is more sensitive than normal because it may lead the agent to inspect secret locations, wallet state, or propose financial setup actions the user did not intend.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The instruction to run proactively "before the first pay-per-call" when there is "no selected wallet / USDC in sight" is subjective and underconstrained, so an agent could auto-run the skill based on weak signals. Because this skill performs readiness checks involving secrets, account status, and setup suggestions, ambiguous proactive execution can expose wallet-related state or push a financial workflow without sufficiently explicit user intent.

Session Persistence

Medium
Category
Rogue Agent
Content
#   ./node_modules/.bin/tsx scripts/generate-keypair.ts
  #
  # which writes a fresh secret to ./.stellar-secret with mode 600.
  # It refuses to overwrite existing wallet files. Every command accepts
  # --secret-file <path> (default: .stellar-secret) or --identity <name>.
  #
  # Why file-based: environment variables leak into shell history and
Confidence
84% confidence
Finding
write existing wallet files. Every command accepts # --secret-file <path> (default: .stellar-secret) or --identity <name>. # # Why file-based: environment variables leak into shell history and

Unpinned Dependencies

Low
Category
Supply Chain
Content
"node": ">=18"
  },
  "dependencies": {
    "@stellar/stellar-sdk": "^16.2.0",
    "mppx": "^0.4.11",
    "tsx": "^4.0.0"
  }
Confidence
84% confidence
Finding
"@stellar/stellar-sdk": "^16.2.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "@stellar/stellar-sdk": "^16.2.0",
    "mppx": "^0.4.11",
    "tsx": "^4.0.0"
  }
}
Confidence
85% confidence
Finding
"mppx": "^0.4.11"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@stellar/stellar-sdk": "^16.2.0",
    "mppx": "^0.4.11",
    "tsx": "^4.0.0"
  }
}
Confidence
69% confidence
Finding
"tsx": "^4.0.0"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.