AAWP

• Outcome: Malicious
• Latest audit: May 28, 2026 · 11:08 AM UTC
• Version: 2.1.0

Overview

This is a real autonomous crypto wallet skill, but it grants broad signing, daemon, backup/restore, and system-file authority with several under-disclosed key-handling and install risks.

Install only if you intend to give an AI agent real wallet-signing authority. Use an isolated machine or account, start with testnet or tiny funds, inspect the native binary source/provenance, avoid restoring untrusted backups, and do not rely on this for unattended mainnet trading until key handling, bootstrap verification, cron behavior, and host-file restore behavior are reviewed and constrained.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (58)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill exposes powerful capabilities including shell execution, network access, environment-variable handling, persistent daemons, and scheduled jobs, yet does not declare permissions explicitly. In a wallet-managing skill, this is dangerous because operators and agent frameworks may underestimate the trust boundary while the skill can execute commands, access secrets, and initiate autonomous financial actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose understates the operational and security-sensitive behavior described by the static analysis: binary/runtime downloads, self-installation into client directories, persistent daemon management, secret provisioning and backup handling, host-identifier access, cron registration, and binary-hash manipulation. In the context of an autonomous crypto wallet, these undisclosed or weakly disclosed behaviors materially expand the attack surface and could enable theft of keys, persistence, supply-chain compromise, or covert host modification.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The installer explicitly tells users that 'This package installs the SKILL.md manifest only,' but when OpenClaw is detected it runs 'clawhub install aawp', which can perform broader network retrieval and installation actions outside simply writing the downloaded manifest. That mismatch weakens user consent and expands the trust boundary to an external package manager path, which is especially risky in a wallet-related skill where users may assume a minimal, non-executing install step.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `createToken()` generates a new Solana mint `Keypair` and returns `mintKeypair: Buffer.from(mintKp.secretKey).toString('base64')` to the caller. Exposing raw private key material from a wallet/agent skill breaks key-isolation expectations and allows any caller, log sink, plugin, or downstream tool to take full control of the mint authority/key outside the intended signing flow.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: `createAndBuy()` repeats the same dangerous pattern by returning the newly generated mint private key after launch and purchase. In an agent-wallet context, this is especially risky because secrets may propagate through model outputs, tool traces, logs, or orchestration layers, enabling unauthorized mint manipulation or asset control.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script downloads a native binary and a corresponding hash, but the verification path calls binary-hash.sh via an undefined SCRIPT_DIR variable. Because the script runs with set -u, this can cause the verification step to fail at runtime after files have already been written, undermining the claimed integrity check and creating a supply-chain risk if a malicious or tampered binary is fetched.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The restore flow writes backup-provided data into host identity files such as /etc/machine-id and /var/lib/aawp/host.salt, which are outside the normal scope of restoring a wallet or agent configuration. Restoring system identity material from an untrusted archive can alter host identity, break trust boundaries, and let a backup influence broader system behavior beyond the wallet itself.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script restores system artifacts including machine identity, host salt, and cache files that are not clearly required for a crypto wallet backup. In the context of an AI-agent wallet skill, this expands restoration from wallet state into host fingerprint and environment manipulation, increasing the chance of persistence, impersonation, or unsafe host mutation from a crafted backup.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: For sign requests, the worker reads a local guardian private key from config/guardian.json and injects it into the outbound payload as gas_key. This exposes a highly sensitive signing credential to another process over a local socket and expands the trust boundary, enabling unauthorized transaction signing or key misuse if the daemon, socket, host, or request path is compromised.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The comment frames the behavior as replacing an internal relay key, but the implementation actually loads a local private key and forwards it in the request payload. That mismatch is dangerous because it conceals secret exfiltration-like behavior during review and increases the chance that a privileged key is used in contexts not intended by operators.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The callers pass a slippageTolerance field into getQuote(), but getQuote() constructs a request body that omits it before sending to Relay. In a wallet/DEX skill, this means the user may believe swaps and bridges are constrained by a chosen slippage while execution actually uses default aggregator behavior, increasing risk of materially worse fills or MEV-induced loss.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The header and usage text materially understate the file’s capabilities. Beyond a simple multi-chain wallet manager, this script supports arbitrary contract calls, approvals, batched execution, bridging/swaps, and extensive Solana trading/token-launch operations, which can mislead users or upstream agents into granting trust and invoking far more powerful behaviors than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The documented backup feature sounds like a normal wallet seed/config export, but the implementation also archives host/system-bound files such as /etc/machine-id, /var/lib/aawp/host.salt, and other recovery material. This creates a stealthy exfiltration path for highly sensitive system identifiers and materials beyond user expectations, especially dangerous in an agent skill that may be invoked automatically.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The call command provides a general-purpose arbitrary contract invocation primitive, including raw calldata mode and optional external ABI loading. In a wallet-agent context, this effectively enables unrestricted on-chain actions through the wallet, bypassing the narrower expectations set by the skill description and dramatically expanding the attack surface to approvals, protocol interactions, asset drains, and malicious contract calls.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The comments claim the wallet manager no longer starts its own daemon, yet the code still runs bootstrap and ensure-daemon helper scripts that can provision binaries or restart supporting processes. This mismatch weakens operator assumptions about trust boundaries and could allow indirect process spawning or environment changes despite the documented guarantee.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly instructs users to provision a signing key and create a live wallet, but does not prominently warn that this initializes real signing capability and can enable autonomous fund movement. In a crypto wallet skill aimed at AI agents, omission of strong risk warnings materially increases the chance of accidental live deployment, unauthorized spending through misconfiguration, or users misunderstanding that the agent can perform irreversible on-chain actions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section includes direct examples for sending assets, swapping, bridging, and contract writes without clear warnings that these commands may broadcast irreversible mainnet transactions. Because the skill is designed to control real wallets and interact with DeFi protocols, users or agents may treat examples as safe demos and unintentionally lose funds, approve malicious contracts, or execute harmful calldata.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The auto-swap price alert feature enables unattended execution of trades when a market condition is met, yet the README does not clearly warn that this can trigger real transactions without a live session. In the context of an autonomous agent wallet with daemon support, this is especially dangerous because volatility, oracle issues, bad routing, or configuration mistakes can cause unintended or repeated asset sales.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The backup and restore instructions identify highly sensitive wallet materials, including encrypted seed material, hardware-binding anchors, the native signing binary, and the Guardian key, but do not provide sufficiently strong operational security guidance. In a wallet system, disclosure, theft, or mishandling of backup artifacts can enable wallet compromise, fraudulent recovery flows, or permanent loss of control over funds.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This setup guide includes directly executable commands for sending funds, approvals, swaps, bridging, restore, and arbitrary contract calls without a prominent warning that blockchain transactions are irreversible, may grant persistent token allowances, and can cause permanent loss if addresses, chains, amounts, or targets are wrong. In a wallet-management skill aimed at AI agents, this omission is more dangerous because users may copy-paste commands or allow automation to execute them with limited human review.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The declarations explicitly describe fetching an AI gate token and injecting it into child processes via the AAWP_AI_TOKEN environment variable. Environment variables are commonly exposed to subprocesses, logs, crash reports, process inspectors, and inherited execution contexts, so using them for sensitive auth material without clear user disclosure or strict scoping increases the risk of credential leakage and unauthorized wallet-manager access. In a crypto wallet skill, such a token likely gates privileged operations, which makes mishandling more dangerous than in a low-privilege application.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The API documentation states that provisioning writes persistent seed-related artifacts to multiple filesystem locations, including a config directory and a hardcoded path under /var/lib/aawp/.cache/fonts.idx. Even if the seed is sharded and encrypted, undisclosed creation of persistent wallet-secret material broadens the attack surface, complicates backup/deletion expectations, and can surprise operators who may not secure or monitor all storage locations appropriately. The use of a disguised cache-like filename also raises suspicion because it may hinder visibility into where sensitive material resides.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The daemon writes a predictable lock file into /tmp and does so synchronously without validating ownership, permissions, or whether the path is a symlink. On multi-user systems, this can enable symlink or race-condition attacks, leak the private socket path to other local users, and let an attacker interfere with daemon coordination or misdirect clients to a malicious socket.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This code reads a guardian private key from a local file or environment variable and forwards it as `gas_key` to `socketQuery`, which appears to send it to another component for signing. Transmitting raw private key material outside the local trust boundary materially increases the risk of credential theft, misuse, logging exposure, and full compromise of the wallet or gas-paying account. In a crypto wallet skill, this is especially dangerous because compromise of a signing key can directly enable irreversible asset loss.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Returning a newly generated mint secret key without explicit warning or consent is unsafe because callers may not realize they are receiving highly sensitive material that grants direct control over the mint. In this skill's crypto-wallet setting, secret exfiltration is more dangerous than in ordinary application code because the surrounding system is expected to protect signing keys rather than disclose them.

VirusTotal

VirusTotal engine telemetry is currently malicious for this artifact.

Static analysis

Detected: malicious.env_harvesting, suspicious.dangerous_exec, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: malicious.env_harvesting
• Location: lib/solana-history.js:7

Environment variable access combined with network send.

Critical

• Code: malicious.env_harvesting
• Location: scripts/portfolio.js:152

Environment variable access combined with network send.

Critical

• Code: malicious.env_harvesting
• Location: scripts/swap.js:25

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: bin/install.js:80

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/dca.js:63

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/deploy-clanker.js:96

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/limit-order.js:230

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/nft.js:158

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/portfolio.js:130

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/price-alert.js:129

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/restore-impl.js:17

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/transfer-token-raw.js:46

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/unwrap-weth.js:41

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/wallet-manager.js:96

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/yield.js:445

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/nft.js:29

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/portfolio.js:27

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/swap.js:30