Wallet Safety Checkup

A practical security review skill that checks wallet and backup habits for obvious weak points. Use when the user wants to audit their crypto security setup....

Security Scan

The skill's description says it's self-report only, but the included handler.py attempts to read a hard-coded user home path (SKILL.md) — behavior that doesn't match the stated purpose and could leak local data if executed.

Purpose & Capability

The skill claims to be a chat-driven, self-report wallet audit. Nothing in that description justifies reading files from a user's home directory. handler.py reads /Users/jianghaidong/.openclaw/skills/{skill_name}/SKILL.md via an absolute, hard-coded path, which is disproportionate and unrelated to the described purpose.

Instruction Scope

SKILL.md explicitly says 'self-report only' and 'No real-time scanning or forensic validation.' The runtime code contradicts this by performing filesystem access to a specific local path. The instructions do not mention reading local files or other system state, so the code expands scope unexpectedly.

Install Mechanism

No install spec is provided (instruction-only), which is low risk. There are two small code files bundled, but no installation or external downloads are requested.

Credentials

The skill declares no required environment variables or credentials (appropriate for a self-report tool). However, the code accesses a hard-coded path in a specific user's home directory; while not a credential, this filesystem access may allow reading local files if the handler is executed.

Persistence & Privilege

always is false and normal autonomous invocation is allowed. The skill does not request persistent privileges or modification of other skills. The main concern is the file access behavior combined with the ability to invoke the handler, not a persistent privilege flag.

What to consider before installing

This skill is suspicious because its code tries to read a hard-coded path in a user's home directory (/Users/jianghaidong/.openclaw/skills/{skill_name}/SKILL.md), which is unrelated to the described self-report wallet audit. Before installing or enabling it, ask the publisher why the handler needs to read that path (and why it's hard-coded to a specific home). Prefer a version that: (1) does not perform any filesystem reads, or (2) reads only its own packaged SKILL.md via a relative path or bundled resource, and (3) documents exactly what data it accesses. If you must run it, run it in a constrained/sandboxed environment and do not give it access to sensitive files. If you cannot get a clear explanation, avoid installing or enabling the skill.

A practical security review skill that checks wallet and backup habits for obvious weak points.

Workflow

1. Ask about seed phrase handling, backup location, password practices, 2FA, device hygiene, and phishing habits.
2. Score the setup in plain language: green, yellow, or red.
3. Identify the biggest recoverability and theft risks.
4. Rank fixes by impact and ease.
5. End with a monthly self-check routine.

Output Format

• Safety snapshot
• Top 3 risks
• Fix-now actions
• Nice-to-improve actions
• Monthly re-check list

Quality Bar

• Prioritized and specific.
• Encourages better habits without shaming the user.
• Distinguishes between theft risk and recovery risk.
• Does not overclaim certainty when information is incomplete.

Edge Cases

• If the user refuses to share details, mark areas as unknown, not safe.
• Cannot verify the real security posture of a device or wallet.

Compatibility

• Self-report only, works well in chat.
• No real-time scanning or forensic validation.