Security audit
Security checks for vulnerabilities and agentic risk
This skill is a broad wallet and DeFi control surface for agents, with direct asset-moving and secret-handling methods that lack clear local confirmation or transport safeguards.
Install only in a tightly controlled environment connected to a trusted wallet service. Do not use real private keys or funded wallets unless you have independent confirmations, spending limits, HTTPS or verified local transport, scoped API keys, and clear human approval for every asset-moving or secret-submitting action.
skill.md:1227Sensitive Wallet Private Key and API Credential May Be Transmitted over an Untrusted Plaintext Channel
The sweepWallet operation is explicitly capable of draining all funds from a wallet to another address, yet there is no visible warning, confirmation, or policy restriction in the skill. Because this is a full-balance transfer primitive, any misuse can result in immediate and total asset loss.
The importWallet method sends raw private keys to a remote wallet service over an HTTP-configurable endpoint, with no visible confirmation, trust validation, or local-only handling. This can directly compromise all funds controlled by the key if the service is malicious, intercepted, or misconfigured.
The sendPayment operation performs value transfer immediately through the backend service without any built-in confirmation, policy gate, recipient verification, or transaction preview. In an autonomous agent context, prompt manipulation or logic errors could trigger unauthorized transfers of funds.
The sendToken method enables immediate ERC-20 transfers without any visible user confirmation or independent validation of token and recipient details. This creates a direct path for draining token balances through prompt injection, bad automation, or malicious upstream instructions.
The swapTokens operation executes trades directly without visible confirmation, slippage disclosure, route review, or cost preview. In DeFi contexts this can cause loss through bad quotes, MEV, manipulated routes, or simply unintended asset conversion initiated by an agent.
The crossChainTransfer function initiates bridge-like transfers without visible confirmation or disclosure of bridge risk, destination finality, delays, or fees. Cross-chain operations are especially dangerous because mistakes can strand funds or expose them to protocol compromise across multiple systems.
Executing a multisig transaction is a state-changing, value-bearing action, yet the skill exposes it without any visible local confirmation or execution review. Although multisig offers some protection, this wrapper still allows an agent to trigger final execution of already-approved transactions with limited safeguards.
The skill presents itself as a wallet capability but also exposes agent registry, marketplace, social identity, and webhook management features. This scope expansion increases the attack surface and enables data exfiltration, third-party interaction, and remote callback behavior that are not necessary for core wallet operations, making misuse or over-privileged deployment more likely.
The staking method can lock or transform user assets via a DeFi protocol without any built-in disclosure about lockup, liquidity, protocol risk, or withdrawal delays. While not always irreversible, staking changes the risk and availability profile of funds and should not be silently executed by an agent.
The borrowFromLending method creates debt obligations through a lending protocol without visible warnings about collateralization, interest, liquidation, or repayment risk. An autonomous agent could accidentally create unsafe positions that lead to liquidation and financial loss.
The ENS registration method performs an on-chain purchase-like action without visible disclosure of registration cost, renewal implications, and transaction fees. This can lead to unintended spending by agents, especially when name registration is treated as a simple availability check follow-up.
The webhook registration function transmits a secret to a remote service without visible warning or assurances about storage, transport security, or scope. If the backend or network path is compromised, webhook secrets could be exposed and used to forge event deliveries or pivot into connected systems.
The diagnostics feature includes a remediation path that can invoke remote fixes through the wallet service, which goes well beyond passive health inspection. In an agent setting, a 'fix' endpoint can become a powerful remote action surface capable of changing wallet, policy, or service state without strong local review.
No suspicious patterns detected.