Clawcast - Easiest Ethereum Crypto Wallet

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:41 AM UTC
• Version: 1.0.2

Overview

This EVM wallet skill is purpose-related, but it stores and handles wallet secrets unsafely and runs unverified installer commands, so users should review it carefully before installing.

Only install this for low-value test wallets unless you first change the workflow: do not store seed phrases, private keys, or keystore passwords in local plaintext files, avoid curl-to-bash installation, remove sudo package installation, make logging opt-in, and require explicit approval before checking balances or revealing wallet paths. The security badge in the README should not be treated as a substitute for reviewing these risks.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/01_install_cast.sh:18

Finding

Unverified Remote Installer Is Downloaded and Executed

Content

View full analysis

/dev/null 2>&1 || true done fi if ! has_cmd foundryup; then err "foundryup not found after install. Make sure ${FOUNDRY_BIN_DIR} is in PATH, then re-run." exit 1 fi foundryup ``` ### Technical Analysis The script pipes a mutable HTTPS response directly into `bash`. It does not pin an installer version, verify a cryptographic checksum or signature, save the response for inspection, or constrain what the downloaded program can modify. The subsequent `foundryup` invocation retrieves and installs further executable content through the same unpinned update channel. The URL appears associated with the legitimate Foundry project, but domain reputation alone is not an integrity control. Compromise of the server, distribution infrastructure, DNS or TLS trust chain, or upstream release process could change the effective code after this Skill has been reviewed. The downloaded code executes with all permissions of the user running onboarding and can access the wallet secrets subsequently created under that account. ### Attack Path 1. A user runs `scripts/run.sh` or `scripts/01_install_cast.sh` on a system where `cast` is absent. 2. The script requests the current response from `https://foundry.paradigm.xyz`. 3. An attacker who compromises the distribution endpoint or its delivery chain substitutes malicious shell content. 4. The response is immediately interpreted by `bash` without integrity verification. 5. The payload executes as the invoking user and may modify shell profiles, install persistent files, or wait for ...[truncated 549 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/03_password.sh:19

Finding

Plaintext Keystore Password Is Persisted Beside the Keystore

Content

View full analysis

"${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" ``` ### Technical Analysis The Skill stores the keystore decryption password in plaintext as `~/.agent-wallet/pw.txt` while storing the copied encrypted keystore in the same application directory. Although `umask 077` and mode `0600` reduce access by other local users, they do not provide meaningful separation between the encrypted asset and the credential that decrypts it. Any process, malware, backup service, workspace integration, or attacker capable of reading the user's application directory can obtain both components. This design largely defeats the protection expected from keystore encryption. Password persistence is mandatory because `SAVE_PASSWORD` is unconditionally set to `y`; the user is not given a safer non-persistent option. ### Attack Path 1. The user completes wallet onboarding. 2. The script writes `keystore.json` and plaintext `pw.txt` beneath `~/.agent-wallet`. 3. A process operating as the same user, an account attacker, or a backup disclosure exposes that directory. 4. The attacker obtains both the encrypted keystore and its plaintext password. 5. The attacker decrypts the keystore or invokes `cast` with `--password-file`. 6. The attacker signs and broadcasts unauthorized transactions. ### Impact Assessment An attacker who can read the wallet directory can recover signing ...[truncated 287 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/00_lib.sh:280

Finding

Mnemonic, Private Key, and Password Are Exposed Through Process Metadata

Content

View full analysis

/dev/null 2>&1; then printf "" return 0 fi local out set +e out=$(cast wallet derive --mnemonic "$mnemonic" --hd-path "$hdpath" 2>/dev/null || true) if [[ -z "$out" ]]; then out=$(cast wallet derive "$mnemonic" --hd-path "$hdpath" 2>/dev/null || true) fi set -e ``` Related password and private-key exposure occurs at `scripts/03_password.sh:43-52`: ```bash dim "If cast prompts you, enter the password you just set." set +e CAST_UNSAFE_PASSWORD="$PW" \ cast wallet import "$acct_name" --private-key "$PRIVATE_KEY" rc=$? if [[ $rc -ne 0 ]]; then warn "Non-interactive import failed; falling back to interactive mode." CAST_UNSAFE_PASSWORD="$PW" \ cast wallet import "$acct_name" --interactive rc=$? fi ``` ### Technical Analysis The mnemonic and private key are placed directly in the command-line argument vector of child processes. The password is exported through `CAST_UNSAFE_PASSWORD` into the child process environment. Process arguments may be visible through process inspection tools, audit frameworks, monitoring agents, diagnostic snapshots, or same-account observation. Process environments may likewise be available through operating-system process interfaces, debuggers, crash handlers, or instrumentation. These values are not ordinary API credentials: the mnemonic and private key confer permanent wallet control, while the password decrypts the locally persisted keystore. Hiding terminal echo does not mitigate disclosure after the values are inserted into process metadata. ### Attack Path 1. The user imports a mnemonic or private key or creates the encrypted keystore. 2. The shell starts `cast` ...[truncated 909 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/02_wallet.sh:178

Finding

Mnemonic and Private Key Are Written to Plaintext Temporary Files

Content

View full analysis

"${MNEMONIC_FILE}" chmod 600 "${MNEMONIC_FILE}" || true ok "Recovery words saved to ${MNEMONIC_FILE}" cleanup_note="$(schedule_mnemonic_file_cleanup "${MNEMONIC_FILE}")" warn "Mnemonic file will be deleted in ~1 hour (${cleanup_note})." else warn "Could not automatically capture the mnemonic from cast; please record it securely now." fi fi if ! [[ "$PRIVATE_KEY" =~ ^0x[0-9a-fA-F]{64}$ ]]; then err "Private key format invalid." exit 1 fi printf "%s" "${PRIVATE_KEY}" > "${PK_TMP}" chmod 600 "${PK_TMP}" || true ok "Wallet material prepared." warn "A temporary private key file was created: ${PK_TMP}" ``` The cleanup routine at `scripts/02_wallet.sh:76-91` is best-effort: ```bash schedule_mnemonic_file_cleanup() { local target="$1" if ! ensure_at_available; then warn "Mnemonic file ${target} won't auto-delete (no 'at'). Please remove it after ~1 hour." return fi local job_output rc set +e job_output="$(printf 'rm -f -- %q\n' "$target" | at now + 1 hour 2>&1)" rc=$? set -e if [[ $rc -eq 0 ]]; then ok "Mnemonic file scheduled for deletion (${job_output//$'\n'/; })." else warn "Scheduling deletion failed (${job_output//$'\n'/; }). Please remove ${target} manually." fi } ``` ### Technical Analysis The generated recovery phrase is intentionally stored unencrypted for approximately one hour. The derived private key is also stored in `privatekey.tmp` until the next onboarding stage successfully imports and deletes it. Mode `0600` limits cross-user access but does not protect against same-account compromi ...[truncated 1259 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/02_wallet.sh:44

Finding

Wallet Onboarding Performs Unnecessary Privileged Package Installation

Content

View full analysis

/tmp/at-install.log 2>&1"; then warn "Failed to install 'at' with sudo; mnemonic cleanup will be manual." return 1 fi else if ! sh -c "$installer > /tmp/at-install.log 2>&1"; then warn "Failed to install 'at'; mnemonic cleanup will be manual." return 1 fi fi hash -r if has_cmd at; then ok "Installed 'at' so mnemonic cleanup can be scheduled." return 0 fi ``` ### Technical Analysis Generating a wallet may invoke `sudo` and install the system package `at` solely to schedule deletion of a mnemonic file. System-wide package installation is not necessary for EVM wallet creation, key import, keystore encryption, network selection, or balance lookup. It expands the trusted code base, modifies system state outside the Skill's application directory, and crosses a privilege boundary for a cleanup mechanism that can be avoided entirely by not writing the mnemonic to disk. The command itself is fixed rather than user-injected, so this is not a shell-injection finding. The issue is that the requested administrative privilege exceeds the minimum needed for the declared functionality. ### Attack Path 1. A user chooses to generate a new wallet. 2. The Skill writes the mnemonic to a plaintext file and attempts to schedule its deletion. 3. If `at` is absent, the Skill invokes ` ...[truncated 776 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (31)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill explicitly instructs the agent to capture a newly generated mnemonic and save it to a local plaintext file, then disclose the path. Persisting a seed phrase on disk, even temporarily, creates a direct wallet-compromise path because any local compromise, backup system, log collector, or multi-user environment could recover the secret and drain funds.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill states that the keystore password is saved to a local helper file for later reuse. Storing the decryption password alongside the keystore materially weakens the protection of the encrypted wallet, because an attacker who gets local file access may obtain both the keystore and its unlocking secret.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The script downloads installer content from a remote URL and immediately executes it, giving that remote content full code execution in the user's shell. If the upstream site, network path, DNS, or hosting is compromised, the installer can run arbitrary commands, steal wallet material, or modify the environment persistently.

Content

Scanner excerpt · scripts/01_install_cast.sh (reported line 15)May include surrounding context.

sh

exit 0
fi
if ! has_cmd curl; then
  err "curl is required but not found. Install curl and re-run."
  exit 1
fi
warn "cast not found. Installing Foundry..."

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The curl ... | bash pattern is a classic unsafe command chain because untrusted network data flows straight into a shell interpreter with no validation. In this skill's context, which manages EVM wallets and transactions, compromise is especially dangerous because a malicious installer could exfiltrate private keys, alter transaction tooling, or tamper with RPC/network settings.

Content

Scanner excerpt · scripts/01_install_cast.sh (reported line 19)May include surrounding context.

sh

exit 1
fi
warn "cast not found. Installing Foundry..."
curl -L https://foundry.paradigm.xyz | bash
enable_strict_path
if ! has_cmd foundryup; then
  for p in "${HOME}/.bashrc" "${HOME}/.zshrc" "${HOME}/.profile"; do

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requests behavior that clearly requires shell execution and file read/write access, but it declares no explicit tool scope or permissions boundary. That creates an authorization gap where an agent may execute sensitive local operations without the user or runtime having a clear, reviewable contract for what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill describes the token JSON as an authoritative reference source, then later instructs the agent to mutate that same asset during onboarding. Mixing trusted reference data with user-driven writes undermines integrity and can poison future network/token recommendations, contract validation, or explorer URL generation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill is built around persistent local wallet state, including keystores, passwords, and network metadata stored under a shared home-directory path. Session persistence is especially risky for crypto operations because later sessions or unrelated tasks may inherit access to highly sensitive wallet material without renewed consent.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

## Scripts

- **Step scripts** — `scripts/01_install_cast.sh`..`06_finish.sh` cover the onboarding flow described in the README: install Foundry/cast, create or import a key, encrypt the keystore, choose network/RPC/tokens (sourced from the JSON assets), and show the resulting address and balance. Run them in order when the user requests onboarding. Each script already prompts for the necessary inputs (mnemonic/private key, password, RPC URL, token details), so relaying the same questions to the user and then running the next script is the recommended approach.
- **Wallet health check** — `scripts/check_wallet.sh` inspects the shared state and reports whether a keystore/address pair already exists; it returns success (0) when a wallet is present and 1 otherwise.
- **Network status** — `scripts/show_network.sh` prints the active network name, chainId, and RPC URL from `~/.agent-wallet/state.env`, or warns if the configuration is incomplete.
- **Wallet removal** — `scripts/remove_wallet.sh` safely deletes the keystore, password stash, and metadata from `~/.agent-wallet/state.env` after an explicit confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 81% confidence

Finding

The skill instructs the agent to automatically check for an existing wallet each session and immediately reveal the saved address, keystore path, network status, and balance without a fresh user request. In a wallet-management context, this exposes sensitive financial metadata and local filesystem details proactively, which can leak information to unintended viewers or contexts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

Always ask the user, right before running each script, exactly the question that script itself will ask (password, network choice, etc.). Do not invent or fill in answers on their behalf—only use the information they explicitly provide. This keeps onboarding faithful to what they chose and avoids pushing the scripts forward with made-up data.

1. **Start with targeted help if stuck.** Pipe `cast --help` through `grep` (e.g., `cast --help | grep balance`) to zero in on the relevant subcommand and avoid scrolling the entire manual; this saves tokens and keeps the answer focused before you proceed or explain anything.
2. **Automatic readiness check.** Run `scripts/check_wallet.sh` automatically each session; do not ask the user to trigger it. If it detects an existing wallet, immediately display the saved address/keystore path and proceed to show the balance/network status (see next step) so the user sees “wallet ready” without extra probes.
3. **Show wallet + network status.** When `check_wallet` finds a wallet, run `scripts/show_network.sh` and query the balance (e.g., `cast balance <ADDRESS> --rpc-url <RPC_URL> --ether`) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually.
4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3:
   1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This instruction involves collecting and persisting core wallet secrets such as mnemonics or private keys as part of the onboarding workflow. In the context of EVM wallet management, retaining such secrets across sessions is extremely dangerous because compromise of the stored material grants full control over user funds.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

3. **Show wallet + network status.** When `check_wallet` finds a wallet, run `scripts/show_network.sh` and query the balance (e.g., `cast balance <ADDRESS> --rpc-url <RPC_URL> --ether`) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually.
4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3:
   1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding.
   2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (`m/44'/60'/0'/0/0`), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by `cast wallet new`, save it to `~/.agent-wallet/mnemonic-words-<timestamp>.txt`, and tell the user the exact path plus the fact that a job (via `at now + 1 hour` if available or a background `sleep` fallback) will delete that file after 60 minutes so the seed phrase does not linger.
   3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step.
   4. Network — read aloud the default network list derived from `assets/evm-networks.json`, ask which numbered network they want, and note 
...[truncated 25 chars]

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

The onboarding flow normalizes agent-driven progression through wallet setup details such as key handling, password capture, network selection, and token modification, while explicitly removing some user verification steps. In a cryptocurrency context, reducing confirmation opportunities increases the chance of accidental misconfiguration, insecure secret handling, or unintended persistence of sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md

4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3:
   1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding.
   2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (`m/44'/60'/0'/0/0`), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by `cast wallet new`, save it to `~/.agent-wallet/mnemonic-words-<timestamp>.txt`, and tell the user the exact path plus the fact that a job (via `at now + 1 hour` if available or a background `sleep` fallback) will delete that file after 60 minutes so the seed phrase does not linger.
   3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step.
   4. Network — read aloud the default network list derived from `assets/evm-networks.json`, ask which numbered network they want, and note that the script now auto-selects the first RPC URL from that entry (it saves the matching `CHAIN_ID`/`ETH_RPC_URL` and then just shows the RPC so the user can see which endpoint is being used).
   5. Tokens — the script now prints the token table derived from `assets/evm-network-tokens.json` so it appears directly i
...[truncated 25 chars]

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The transaction logging instruction expands the skill beyond core cast wallet operations into persistent workspace surveillance. Recording transaction mentions, hashes, addresses, and reasons in a separate log creates unnecessary retention of sensitive financial metadata that is not required for the primary wallet task.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Appending wallet addresses, transaction hashes, and contextual notes to a persistent workspace log creates a durable record of sensitive financial activity. Even though these are not private keys, they enable identity linkage, transaction profiling, and unintended disclosure across sessions or to anyone with workspace access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to create persistent logs containing wallet addresses and transaction hashes without warning the user that durable records are being created. This is dangerous because blockchain activity is highly linkable, and silent persistence increases privacy risk, forensic exposure, and accidental disclosure to later sessions or other tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/evm-network-tokens.json (reported line 229)May include surrounding context.

json

"name": "Avalanche C-Chain",
      "chainId": 43114,
      "rpcUrls": [
        "https://api.avax.network/ext/bc/C/rpc"
      ],
      "links": {
        "docs": "https://build.avax.network/docs/primary-network",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/evm-networks.json (reported line 88)May include surrounding context.

json

"name": "Avalanche C-Chain",
      "chainId": 43114,
      "rpcUrls": [
        "https://api.avax.network/ext/bc/C/rpc"
      ],
      "links": {
        "docs": "https://build.avax.network/docs/primary-network",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 93)May include surrounding context.

sh

ensure_app_dir() {
  mkdir -p "${APP_DIR}"
  chmod 700 "${APP_DIR}" || true
}

state_init() {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function derives a private key directly from a provided mnemonic, meaning extremely sensitive wallet seed material is handled in-process without any explicit warning, consent flow, or hygiene controls. In a wallet-management skill this is materially risky because mnemonics and derived private keys may be exposed through shell history, process arguments, logs, crash output, or downstream command behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script expands its capabilities beyond wallet management by attempting to install the system 'at' package via apt and optionally sudo. In a wallet-onboarding context, introducing package installation and privilege escalation increases host risk, can trigger unexpected admin prompts or changes, and is unnecessary for handling sensitive key material safely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This line invokes sudo to execute package installation, introducing privileged system modification into a script primarily meant for wallet setup. In a security-sensitive workflow dealing with private keys and mnemonics, unexpected root-level actions materially increase attack surface and the consequences of misuse or compromise.

Content

Scanner excerpt · scripts/02_wallet.sh (reported line 57)May include surrounding context.

sh

return 1
  fi
  if [[ -x "/usr/bin/sudo" ]]; then
    if ! sudo sh -c "$installer > /tmp/at-install.log 2>&1"; then
      warn "Failed to install 'at' with sudo; mnemonic cleanup will be manual."
      return 1
    fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 103)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 130)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 140)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 158)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/00_lib.sh (reported line 200)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/02_wallet.sh (reported line 183)May include surrounding context.

sh

state_set "SAVE_PASSWORD" "y"
umask 077
printf "%s" "$PW" > "${PASSWORD_FILE}"
chmod 600 "${PASSWORD_FILE}" || true
ok "Password saved to ${PASSWORD_FILE}"
acct_name="agent"
state_set "KEYSTORE_NAME" "${acct_name}"

Static analysis

No suspicious patterns detected.