Security audit

Privy Agentic Wallets

Security checks across malware telemetry and agentic risk

Overview

This is a high-risk but coherent Privy wallet skill that discloses its fund-moving capabilities and includes substantial safety controls.

Use this only with a dedicated Privy app and limited funds. Keep PRIVY_APP_SECRET out of source control and chats, prefer environment variables or a secrets manager, start on testnets or low-value wallets, configure strict spending limits and allowlists, and require human review for any value-bearing transaction or signature.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README promotes autonomous wallet creation and transaction execution but does not warn users that blockchain transactions are irreversible, may move real funds, and can expose users to loss if prompts or policies are wrong. In the context of an agent skill specifically designed for server-side wallets and autonomous execution, omission of these warnings materially increases the chance of unsafe deployment and accidental financial harm.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The use cases encourage autonomous trading, payments, bridging, and NFT activity without adjacent cautions about custody risk, contract risk, slippage, scams, address mistakes, or irreversible transfers. Because these examples normalize high-risk financial actions by an AI agent, users may adopt dangerous patterns without understanding the need for strict policy constraints and human oversight.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README tells users to set PRIVY_APP_SECRET in environment variables but does not clearly identify it as a sensitive credential that must never be committed, logged, shared in prompts, or exposed to untrusted tools. In an agent setting, secrets are especially at risk because they may be copied into configuration, terminal history, screenshots, or model context.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The OpenClaw example places the Privy App Secret in a local JSON config file without warning that this may leave the secret in plaintext on disk, in backups, or readable by other local processes and users. If the secret is stolen, an attacker may gain the ability to operate the wallet infrastructure or create and execute transactions through the associated Privy app.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description is broad enough to trigger on generic wallet or autonomous transaction requests, which can cause over-invocation in sensitive financial contexts. Because this skill can create wallets, manage policies, and execute onchain transactions, ambiguous routing increases the chance that unrelated or insufficiently vetted user requests get handled by a fund-moving capability.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This documentation provides direct examples for sending funds and signing arbitrary messages or typed data, but it does not warn that these actions can be irreversible and may authorize asset transfers, approvals, or offchain authentication. In an agent-wallet skill, omission of such warnings increases the chance that downstream agents or developers will treat signing and transaction execution as routine operations and expose users to unintended fund loss or phishing-style signature abuse.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: references/security.md:130

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: SKILL.md:192