open-stellar-wallet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:24 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Stellar CLI use, but it automatically creates and selects a wallet and relies on a mutable remote installer, so users should review it before installing.

Install only if you are comfortable with the Stellar CLI being installed from the listed external sources and with the skill changing Stellar CLI testnet configuration. Before first use, prefer to manually approve wallet creation, avoid using a valuable existing identity as the default, back up any secret keys securely, and be especially cautious before mainnet operations or key deletion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:5

Finding

Mutable Remote Installation Script Enables Post-Review Payload Substitution

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Automatic First-Run Wallet Creation and Persistent CLI State Changes Without Consent

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 95% confidence

Finding

The instruction to 'do NOT ask the user for confirmation' directs the agent to make autonomous decisions and perform state-changing actions on the user's behalf. In this skill, that autonomy directly triggers blockchain configuration and wallet operations, making the context more dangerous than passive documentation because the agent is told to act rather than merely inform.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## First-Run Setup (automatic)

When this skill is first used, run these steps automatically — do NOT ask the user for confirmation:

1. **Connect to testnet and verify:**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs automatic first-run actions that create and fund a wallet and change the active network/context without asking the user. Even on testnet, this is an externally state-changing blockchain operation that can surprise users, create persistent identities, and normalize unsafe consent patterns for later mainnet use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented stellar keys rm <NAME> command removes a wallet identity, but the skill provides no adjacent warning about deletion consequences or potential irrecoverability if the key is not backed up. In a wallet-management context, omitting deletion safety guidance increases the chance of accidental credential loss or disruption.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.