Security audit

Open Wallet

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and transparent about wallet actions, but it exposes broad wallet-signing and transaction authority plus automatic result redirects that users should review carefully before installing.

Install only if you are comfortable with agents creating links that can ask your wallet to sign messages or submit transactions. Before opening any generated link, verify the chain, target address or contract, function, value or token amount, and whether the result will be redirected to another site. Avoid redirect_url for signatures unless the destination is trusted.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:87
Finding: Sensitive Wallet Results Can Be Redirected to Arbitrary Destinations
Content: View full analysis
` OR - `resultType=json` and `result=` - On failure: - `error=` Template mode (no bridge, good for messaging apps): - If `redirect_url` contains `{{...}}`, placeholders are replaced and no query params are appended. - Placeholders: - `{{result}}`: URL-encoded result string (or URL-encoded `JSON.stringify(result)`) - `{{result_raw}}`: unencoded result string (or `JSON.stringify(result)`) - `{{resultType}}`: `string` or `json` - `{{error}}`: URL-encoded error message - `{{error_raw}}`: unencoded error message Implementation note for agents: - Consider generating a “compose draft” deep link into your chat with the user and using that as `redirect_url` so, after approval, the user lands in a pre-filled message back to you containing the result. ``` ### Technical Analysis The skill permits the caller to choose a `redirect_url` to which wallet operation results are transmitted. These results may include transaction hashes, message signatures, typed-data signatures, structured JSON responses, or error information. The documented design does not require: - An allowlist of trusted redirect origins. - HTTPS for redirect destinations. - Origin or destination validation. - Explicit disclosure of the final result recipient. - User confirmation before transmitting a signature. - Separation between ordinary transaction identifiers and authorization-bearing cryptographic signat ...[truncated 1914 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:16
Finding: Unrestricted Wallet RPC Requests Enable Transaction and Signature Abuse
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill says the page will switch the user's wallet to the requested chain and execute the JSON-RPC request, but the guidance does not require a strong user-facing warning about network switching, transaction signing, and possible asset movement. In a wallet-action skill, silently normalizing chain switching and execution increases the risk that users approve actions on the wrong network or misunderstand the financial consequences of signing or submitting a transaction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly supports sending wallet action results and errors to an arbitrary redirect_url, including template substitution into third-party URLs, but does not prominently warn that signatures, transaction hashes, and error details may be disclosed to external services. In a wallet-signing context, even 'non-secret' outputs can be sensitive, linkable to a user identity, or misrouted to attacker-controlled destinations, creating privacy leakage and facilitating phishing or workflow hijacking.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.