ClawHub
Back to skill

Security audit

one-wallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill is mostly coherent, but it gives agents broad authority around irreversible blockchain transactions and private keys without enough guardrails.

Review before installing. Use this only in a dedicated, least-privileged environment with test wallets or limited funds. Do not paste real private keys into commands or chat transcripts, avoid -y unless a recipient and amount are pre-approved, pin the CLI version or commit where possible, and require explicit confirmation before any transaction, approval, contract write, wallet deletion, or signature.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:38
Finding

Unpinned Third-Party Package Installation and Build

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:106
Finding

Private Keys Exposed Through Command-Line Arguments

Content
View full analysis
--private-key 0xYourPrivateKey # Import with password: one-wallet wallet import --private-key 0xYourPrivateKey --password --set-default ``` ### Technical Analysis The documented import workflow places an EVM private key directly in a command-line argument. Depending on the operating system, shell, and execution environment, command arguments can be exposed through: - Shell history files - Process listings and process-inspection interfaces - Terminal session recording - CI/CD command logs - Agent execution transcripts - Debugging, audit, or telemetry systems Password-protecting the resulting wallet does not protect the private key while it is present in the command invocation. Because an EVM private key directly authorizes signatures, disclosure is sufficient to impersonate the wallet owner without compromising the wallet application's stored encrypted data. ### Attack Path 1. A user substitutes a real private key into the documented `--private-key` argument. 2. The shell, operating system, automation platform, or logging system records or exposes the command. 3. A local user, administrator, log reader, CI operator, or attacker with access to the relevant history or telemetry obtains the private key. 4. The attacker imports the key into another wallet or signing tool. 5. The attacker signs unauthorized transactions or messages without requiring access to the original `one-wallet` installation. ### Impact Assessment An exposed private key grants control over the corresponding EVM account. An attacker can transfer native currency and tokens, move NFTs, approve token spenders, interact with contracts, and produce valid signatures as that account. Transactions are generally ...[truncated 112 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The overview advertises wallet creation, sending transactions, contract interaction, and signing without an immediate warning that these actions can move funds irreversibly or authorize on-chain effects. In an agent setting, presenting destructive financial capabilities up front without strong cautionary framing increases the risk of accidental loss, misuse, or unsafe execution based on ambiguous user requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill says to use one-wallet for Ethereum/EVM tasks that can be done via CLI, even when the user did not specifically request this tool. That broad routing can cause the agent to select a wallet-capable skill for generic blockchain tasks, increasing the chance of exposing wallet operations, signing flows, or transaction commands in contexts where a read-only or safer tool would be more appropriate.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
91% confidence
Finding

The skill explicitly documents use of -y to skip confirmation for transaction sending, which facilitates unattended execution of value-transfer actions. In an autonomous or semi-autonomous agent environment, bypassing confirmations removes an important safety barrier against mistaken recipients, wrong amounts, or malicious prompt steering that leads to irreversible on-chain transactions.

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

one-wallet wallet send 0xRecipientAddress 0.1

text

Skip confirmation for scripts:

```bash
one-wallet wallet send 0xRecipientAddress 0.1 -y

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md
- Never hard-code real private keys or passwords in source-controlled files.
- Prefer `ONE_WALLET_KEY_<NAME>` and `ONE_WALLET_PASSWORD_<NAME>` environment variables for secrets.
- Use `--json` for automation; omit it for quick human inspection.
- Use `-y` only in scripts or when the user explicitly wants to skip confirmations.
- When in doubt about the chain or RPC, call `one-wallet provider info` before sending transactions.

## Reference

Static analysis

No suspicious patterns detected.