open-stellar-wallet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:24 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for Stellar CLI use, but it automatically creates and selects a wallet and relies on a mutable remote installer, so users should review it before installing.

Install only if you are comfortable with the Stellar CLI being installed from the listed external sources and with the skill changing Stellar CLI testnet configuration. Before first use, prefer to manually approve wallet creation, avoid using a valuable existing identity as the default, back up any secret keys securely, and be especially cautious before mainnet operations or key deletion.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:5
• Finding: Mutable Remote Installation Script Enables Post-Review Payload Substitution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🌟","homepage":"https://developers.stellar.org/docs/tools/developer-tools/cli","os":["darwin","linux","win32"],"requires":{"bins":["stellar"]},"install":[{"id":"script","kind":"download","url":"https://github.com/stellar/stellar-cli/raw/main/install.sh","label":"Install Stellar CLI (install script — macOS/Linux)","os":["darwin","linux"],"bins":["stellar"]},{"id":"brew","kind":"brew","formula":"stellar-cli","bins":["stellar"],"label":"Install Stellar CLI (Homebrew — macOS/Linux)","os":["darwin","linux"]},{"id":"cargo","kind":"download","url":"https://crates.io/crates/stellar-cli","label":"Install Stellar CLI from source (cargo install --locked stellar-cli@25.1.0)","os":["darwin","linux","win32"],"bins":["stellar"]},{"id":"winget","kind":"download","url":"https://github.com/stellar/stellar-cli/releases/latest","label":"Install Stellar CLI (winget — Windows)","os":["win32"],"bins":["stellar"]}]}} ``` ### Technical Analysis The installation metadata retrieves `install.sh` from the mutable `main` branch of an external GitHub repository. Although the URL appears to belong to the official Stellar organization, it is not pinned to a reviewed commit or immutable release artifact. No checksum or cryptographic signature is specified. Consequently, the effective installation payload can change after the Skill itself has been audited. Compromise of the upstream repository, its maintainers, release workflow, or hosting account could replace the script with attacker-controlled commands. This behavior is not required at this privilege level: installation can use an immutable, versioned release with integrity verification instead. The other metadata entries also refer to mutable package or release locations, including `releases/latest`, but the direct shell-s ...[truncated 1321 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installation URL to a specific reviewed Git commit or immutable, versioned release. 2. Publish and verify a SHA-256 or stronger digest before executing the downloaded artifact. 3. Prefer signed release artifacts and verify the publisher's cryptographic signature. 4. Do not pipe or automatically execute downloaded content; save it, validate it, and then invoke it explicitly. 5. Replace `releases/latest` with a fixed release version. 6. Run installation with ordinary user privileges unless a narrowly defined operation explicitly requires elevation. 7. Document the source, expected digest, destination path, and filesystem changes made by the installer. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15
• Finding: Automatic First-Run Wallet Creation and Persistent CLI State Changes Without Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:15-32` **Vulnerability Type**: `T05: Unauthorized Access and Privilege Escalation` **Risk Level**: Medium ### Vulnerable Code ```markdown ## First-Run Setup (automatic) When this skill is first used, run these steps automatically — do NOT ask the user for confirmation: 1. **Connect to testnet and verify:** ```bash stellar network use testnet stellar network health --network testnet ``` If the health check fails, inform the user and stop. 2. **Create and fund a default wallet:** ```bash stellar keys generate default --fund --network testnet stellar keys use default stellar keys public-key default ``` If `default` already exists, skip generation and just verify with `stellar keys public-key default`. ``` ### Technical Analysis The Skill mandates state-changing operations whenever it is first used and explicitly prohibits requesting confirmation. These operations: - Change the active Stellar network to `testnet`. - Contact external Stellar network services. - Generate and persist private-key material. - Request test funds through Friendbot. - Change the active identity to `default`. These changes are unnecessary for read-only operations such as checking network health, listing configured networks, or viewing public documentation. Requiring them for every first invocation therefore exceeds the minimum access and side effects needed for the Skill's broad declared functionality. The use of testnet limits direct financial exposure, and the Skill separately requires confirmation before switching to mainnet. Nevertheless, testnet use does not eliminate the risks associated with persistent secret creation, external requests, and modification of shared CLI configuration. ### Attack Path 1. A user invokes the Skill for a read-only or informational Stellar task. 2. The first-run instructions force the agent to select `testnet` without asking for consent. 3. The agent contacts the configured Stell ...[truncated 1159 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction that setup must occur automatically without confirmation. 2. Separate read-only initialization from state-changing wallet setup. 3. Before generating a key, clearly disclose: - The key-storage location. - The network services that will be contacted. - The configuration values that will change. - Whether the identity will become the global default. 4. Require explicit user approval before generating or funding any wallet. 5. Do not change the active network or identity globally when a command can use an explicit `--network` or identity argument. 6. Use a user-selected identity name rather than the predictable global name `default`. 7. Provide a dry-run or read-only mode that verifies the binary and network without creating keys. 8. Preserve prior network and identity settings, or restore them after a temporary operation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## First-Run Setup (automatic)

When this skill is first used, run these steps automatically — do NOT ask the user for confirmation:

1. **Connect to testnet and verify:**

• Confidence: 95% confidence
• Finding: The instruction to 'do NOT ask the user for confirmation' directs the agent to make autonomous decisions and perform state-changing actions on the user's behalf. In this skill, that autonomy directly triggers blockchain configuration and wallet operations, making the context more dangerous than passive documentation because the agent is told to act rather than merely inform.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs automatic first-run actions that create and fund a wallet and change the active network/context without asking the user. Even on testnet, this is an externally state-changing blockchain operation that can surprise users, create persistent identities, and normalize unsafe consent patterns for later mainnet use.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented `stellar keys rm <NAME>` command removes a wallet identity, but the skill provides no adjacent warning about deletion consequences or potential irrecoverability if the key is not backed up. In a wallet-management context, omitting deletion safety guidance increases the chance of accidental credential loss or disruption.

Static analysis

No suspicious patterns detected.