Security audit

Monolith — Crypto Wallet

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent crypto wallet skill, but it needs review because it relies on root-installed external wallet components and remote swap data for fund-moving actions without enough verifiable safeguards.

Review this carefully before installing. The JavaScript skill is not obviously deceptive and the risky wallet behavior is mostly disclosed, but installing it means trusting externally downloaded macOS components with persistent wallet authority. Verify release signatures and hashes independently, understand what the daemon can do, and avoid using command-line approval codes or large-value swaps until the external binaries and swap validation path have been independently audited.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:6
Finding: Privileged External Wallet Components Are Installed Without Artifact Integrity Verification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lib/intent-builder.js:236
Finding: Untrusted Uniswap API Calldata Is Forwarded for Signing Without Semantic Validation
Content: View full analysis
amountInWei) return null; const amountOut = BigInt(quote.amount ?? 0); if (amountOut === 0n) return null; return { target, calldata, value: String(value), amountOut }; ``` ```js // Primary: try Routing API const apiResult = await tryRoutingAPI(chainId, weth, tokenOutAddress, amountInWei, maxSlippageBps); if (apiResult) { return { target: apiResult.target, calldata: apiResult.calldata, value: apiResult.value, chainHint: chainId.toString(), quotedAmountOut: apiResult.amountOut, source: 'routing-api', }; } ``` The returned intent is subsequently submitted to the local signing daemon in `scripts/swap.js:48-59`: ```js ...[truncated 3544 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send.js:9
Finding: One-Time Wallet Approval Codes Are Exposed Through Process Arguments and Shell History
Content: View full analysis
[token] [chainId] [approvalCode] * to: recipient address or ENS name * amount: amount to send (in human units, e.g., "0.1" ETH or "100" USDC) * token: "ETH" (default) or "USDC" * chainId: 1 or 8453 (optional, uses daemon's home chain) * approvalCode: 8-digit code from notification (if re-submitting after 202) */ async function main() { const [, , to, amount, token = 'ETH', chainIdStr, approvalCode] = process.argv; ``` ```js // Attach approval code if re-submitting after a 202 if (approvalCode) { intent.approvalCode = approvalCode; } ``` ```js } else if (response.status === 202) { console.log(`Approval required: ${response.data.reason}`); console.log(`Summary: ${response.data.summary}`); console.log(`Expires in: ${response.data.expiresIn}s`); console.log(`\nTo approve, re-run with the 8-digit code from your notification:`); console.log(` send ${to} ${amount} ${token} ${chainId} `); } ``` The swap flow uses the same pattern: ```js /** * Usage: node scripts/swap.js [tokenOut] [chainId] [approvalCode] * amountETH: amount of ETH to swap (e.g., "0.1") * tokenOut: "USDC" (default) or a token address * chainId: 1 or 8453 (default: 8453) * approvalCode: 8-digit code from notification (if re-submitting after 202) */ async function main() { const [, , amountETH, tokenOut = 'USDC', chainIdStr, approvalCode] = process.argv; ``` ```js // Attach approval code if re-submitting after a 202 if (approvalCode) { daemonIntent.approvalCode = approvalCode; } ``` ```js } else if (respo ...[truncated 2780 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Token swap routing, quote handling, symbol resolution, and fallback fee-tier probing all introduce undeclared network- and market-dependent behavior. In a wallet skill, hidden quote/routing logic can influence financial outcomes and trust decisions, especially if third-party API data is accepted without clear disclosure.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The lockfile pins ws to version 8.18.3, and the supplied advisories indicate that this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial-of-service condition. In a crypto wallet skill, WebSocket connectivity is commonly used for blockchain RPC subscriptions and event streams, so a vulnerable ws dependency can expose sensitive process memory or allow a remote endpoint to degrade or crash the agent during wallet operations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises networked and environment-dependent behavior, including downloading/installing local packages and interacting with a local daemon, but does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, missing scope declarations weakens operator visibility and policy enforcement, increasing the chance that a wallet-related skill is granted broader-than-expected access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code sends swap metadata including chain IDs, token addresses, input amount, and slippage tolerance to Uniswap's external Routing API before building the intent. Even though no private keys or signatures are transmitted here, this still leaks potentially sensitive transaction intent and trading behavior to a third party, which can be relevant for privacy, strategy leakage, or compliance-sensitive deployments.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The hardcoded Uniswap API endpoint confirms that transaction quote data is intentionally sent to a third-party service rather than remaining fully local. In the context of a 'secure crypto wallet for AI agents,' undisclosed off-device transmission weakens the privacy expectations created by the skill's security-oriented description, even if execution safety checks reduce direct fund-loss risk.
Content: Scanner excerpt · lib/intent-builder.js (reported line 236)May include surrounding context.
js
configs: [{ routingType: 'CLASSIC', protocols: ['V3'] }], }; const res = await fetch('https://api.uniswap.org/v2/quote', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: The hardcoded Uniswap API endpoint confirms that transaction quote data is intentionally sent to a third-party service rather than remaining fully local. In the context of a 'secure crypto wallet for AI agents,' undisclosed off-device transmission weakens the privacy expectations created by the skill's security-oriented description, even if execution safety checks reduce direct fund-loss risk.
Content: Scanner excerpt · lib/intent-builder.js (reported line 236)May include surrounding context.
js
configs: [{ routingType: 'CLASSIC', protocols: ['V3'] }], }; const res = await fetch('https://api.uniswap.org/v2/quote', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body),

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · lib/runtime-bootstrap.js (reported line 8)May include surrounding context.
js
process.env.MONOLITH_DAEMON_BIN || '/usr/local/bin/MonolithDaemon'; const LAUNCH_AGENT_PATHS = [ process.env.MONOLITH_DAEMON_PLIST || '', `${process.env.HOME}/Library/LaunchAgents/com.monolith.daemon.plist`, '/Library/LaunchAgents/com.monolith.daemon.plist', ].filter(Boolean);

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · lib/runtime-bootstrap.js (reported line 9)May include surrounding context.
js
const LAUNCH_AGENT_PATHS = [ process.env.MONOLITH_DAEMON_PLIST || '', `${process.env.HOME}/Library/LaunchAgents/com.monolith.daemon.plist`, '/Library/LaunchAgents/com.monolith.daemon.plist', ].filter(Boolean);

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · lib/runtime-bootstrap.js (reported line 10)May include surrounding context.
js
const LAUNCH_AGENT_PATHS = [ process.env.MONOLITH_DAEMON_PLIST || '', `${process.env.HOME}/Library/LaunchAgents/com.monolith.daemon.plist`, '/Library/LaunchAgents/com.monolith.daemon.plist', ].filter(Boolean);

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · lib/runtime-bootstrap.js (reported line 70)May include surrounding context.
js
const LAUNCH_AGENT_PATHS = [ process.env.MONOLITH_DAEMON_PLIST || '', `${process.env.HOME}/Library/LaunchAgents/com.monolith.daemon.plist`, '/Library/LaunchAgents/com.monolith.daemon.plist', ].filter(Boolean);

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · lib/runtime-bootstrap.js (reported line 29)May include surrounding context.
js
const domain = `gui/${process.getuid()}`; const service = `${domain}/${DAEMON_LABEL}`; commands.push(`/bin/launchctl bootstrap ${domain} ${shellQuote(launchAgentPath)}`); commands.push(`/bin/launchctl enable ${service}`); commands.push(`/bin/launchctl kickstart -k ${service}`); }

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency uses a caret range (^2.21.0), which allows future minor and patch releases to be installed. In a security-sensitive wallet skill, this increases supply-chain risk because a newly published compromised or breaking dependency version could be pulled in without explicit review, potentially affecting transaction construction, signing flows, or policy enforcement logic.
Content: Scanner excerpt · package.json (reported line 22)May include surrounding context.
json
"test": "node --test 'tests/**/*.test.js'" }, "dependencies": { "viem": "^2.21.0" } }

Static analysis

No suspicious patterns detected.