Clawcast - Easiest Ethereum Crypto Wallet
WarnAudited by ClawScan on May 10, 2026.
Overview
This wallet skill matches its stated purpose, but it stores crypto secrets locally and may run remote or sudo installers during setup, so it should be reviewed before use.
Treat this as a hot-wallet tool. Do not import an existing valuable MetaMask seed or large-balance private key unless you accept local plaintext helper files. Review the scripts before running them, avoid approving unexpected sudo prompts, consider installing Foundry manually, use a trusted RPC endpoint, and delete ~/.agent-wallet secrets when finished.
Findings (6)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone or any process with access to the user account and these wallet files may be able to unlock the wallet and sign transactions without the user re-entering the password.
The script forces saving the keystore password to a local plaintext helper file instead of making password persistence optional.
PASSWORD_FILE="${APP_DIR}/pw.txt" ... state_set "SAVE_PASSWORD" "y" ... printf "%s" "$PW" > "${PASSWORD_FILE}"Use only a fresh, low-value hot wallet unless this storage model is acceptable; prefer not to save wallet passwords in plaintext, use a keychain or hardware wallet, and delete ~/.agent-wallet/pw.txt when not needed.
If setup is interrupted, cleanup fails, or the local account is compromised, wallet seed/private-key material could remain readable on disk.
Wallet onboarding writes highly sensitive recovery words and private-key material to local files, even though the private key is intended to be temporary and the mnemonic file is scheduled for cleanup.
printf "%s\n" "$MNEMONIC" > "${MNEMONIC_FILE}" ... printf "%s" "${PRIVATE_KEY}" > "${PK_TMP}"Do not import an existing high-value wallet seed; verify the mnemonic/private-key temp files are deleted after setup and remove ~/.agent-wallet if you abandon onboarding.
The skill can modify the local system package set and may prompt for elevated privileges during what appears to be wallet onboarding.
During mnemonic cleanup setup, the script may install a system package with sudo, which is not declared in the skill requirements and is not central to wallet creation.
installer="apt-get install -y at" ... sudo sh -c "$installer > /tmp/at-install.log 2>&1"
Do not approve sudo prompts unless you understand them; install optional dependencies manually or ask the skill author to remove the automatic apt install and declare requirements explicitly.
A compromised upstream installer or unexpected Foundry update could affect the local environment used for wallet operations.
Installing Foundry/cast is expected for this skill, but the script executes a remote installer without pinning or verifying a specific version.
curl -L https://foundry.paradigm.xyz | bash ... foundryup
Consider installing Foundry yourself from a verified source, reviewing the installer, and pinning versions where possible.
Your wallet address and balance-check timing may be exposed to the selected RPC provider and shown in the agent conversation.
The skill tells the agent to automatically display the wallet address/keystore path and query the address balance through the configured RPC endpoint.
Run `scripts/check_wallet.sh` automatically each session; do not ask ... query the balance ... `cast balance <ADDRESS> --rpc-url <RPC_URL> --ether`
Use a trusted RPC endpoint and disable or avoid automatic balance checks if wallet privacy matters.
A persistent workspace note can influence later agent behavior and may remain after the original wallet task.
The skill asks the agent to create persistent workspace context when the skill is discovered, not only when the user asks for wallet work.
When this skill is installed or first discovered, make sure to record a TOOLS.md entry summarizing it so the workspace cheat sheet stays up to date.
Review any TOOLS.md entry created by the skill and keep it as a neutral summary without secrets or operational instructions.