ClawHub
Back to skill

Security audit

Agentwallet Sdk

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about being a wallet and DeFi integration, but it gives agents high-impact spending and transaction capabilities without enough scoping or safety guidance.

Review this before installing. Use only pinned, reviewed package versions with a lockfile; isolate the wallet runtime; use low-balance wallets or narrowly scoped session keys; require explicit approval for transfers, swaps, bridges, x402 payments, and identity registration; and configure spend limits plus destination, chain, token, and payable-domain allowlists.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:17
Finding
Unpinned Third-Party Dependencies Used for Privileged Wallet Operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-21`, `SKILL.md:94-102` **Vulnerability Type**: Unpinned third-party npm dependencies **Risk Level**: High ### Vulnerable Code ```bash npm install agentwallet-sdk ``` ```markdown Current version: **v2.4.1** on npm (158 tests passing, 0 compile errors) ``` ```bash npm install @agent-wallet/mastra-plugin ``` ```bash npm install clawpay-mcp ``` ### Technical Analysis The documented installation commands resolve mutable npm package versions without exact version constraints or integrity verification. Although the documentation identifies `agentwallet-sdk` version `v2.4.1`, the installation command does not pin that version. The Mastra plugin and ClawPay MCP package are also installed without pinned versions. This is particularly sensitive because the packages are intended to interact with private signing keys and perform autonomous wallet operations, including transfers, swaps, cross-chain bridging, HTTP payments, and identity registration. The project contains only documentation and metadata; it does not include the dependency source code, a lockfile, or integrity hashes that would permit reproducible verification of the installed implementation. The finding does not establish that any named package is currently malicious. The vulnerability is that following the instructions trusts whichever package release and transitive dependency graph the npm registry resolves at installation time. ### Attack Path 1. An attacker compromises a package publisher account, npm package, or relevant transitive dependency. 2. The attacker publishes a modified version containing malicious installation or runtime behavior. 3. A user follows the documented unpinned `npm install` command. 4. npm resolves the attacker-controlled release because no exact reviewed version or integrity constraint is specified. 5. The installed dependency executes through an installation script or when the agent invokes wallet or MCP ...[truncated 1080 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin each reviewed dependency to an exact version, without range operators: ```bash npm install --save-exact agentwallet-sdk@2.4.1 npm install --save-exact @agent-wallet/mastra-plugin@REVIEWED_VERSION npm install --save-exact clawpay-mcp@REVIEWED_VERSION ``` 2. Commit a generated lockfile containing registry-resolved integrity hashes, and use `npm ci` in automated or reproducible installations. 3. Review the source and published package contents for every pinned release, including lifecycle scripts and transitive dependencies. 4. Disable npm lifecycle scripts where they are unnecessary: ```bash npm ci --ignore-scripts ``` 5. Add automated dependency monitoring, provenance checks, vulnerability scanning, and an explicit approval process before updating pinned versions. 6. Run wallet components with least privilege and isolate them from unrelated credentials, files, and network resources. 7. Apply wallet-level safeguards, including destination and contract allowlists, per-transaction and cumulative spending limits, narrowly scoped session keys, transaction simulation, slippage limits, chain-ID validation, and explicit approval for high-value operations. 8. Clarify that the Skill metadata version `1.0.0` and the documented SDK version `2.4.1` represent separate artifacts, preventing users from confusing the reviewed Skill version with the installed dependency version. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill promotes autonomous wallet creation, transfers, swaps, bridging, and identity registration as normal agent actions but does not warn that these are irreversible on-chain operations that can directly spend funds or create permanent on-chain state. In an agent context, omission of approval limits, confirmation requirements, and loss-of-funds warnings increases the chance that operators enable powerful financial actions without understanding the risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The x402 payment example encourages automatic payment to external APIs with only a maxPayment field and no warning about repeated charges, metadata leakage, or calling untrusted endpoints. For autonomous agents, this can lead to silent spending and privacy exposure if prompts or tool chains cause the agent to pay arbitrary services.

External Transmission

Medium
Category
Data Exfiltration
Content
```typescript
// Pay for API access automatically
const response = await wallet.x402Pay({
  url: 'https://api.example.com/data',
  maxPayment: '0.001', // ETH
});
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains very generic terms such as "wallet," "payment," "bridge," "swap," and "transfer," which can cause the skill to activate in many unrelated conversations. Because this skill is a wallet/DeFi tool with access to an execution capability, overbroad activation increases the chance of unintended invocation in financially sensitive contexts, potentially leading to unsafe actions or user confusion.

Static analysis

No suspicious patterns detected.