Security audit

wallet

Security checks across malware telemetry and agentic risk

Overview

This is a real wallet sandbox skill, but it includes several high-impact behaviors users should review before installing.

Install only if you trust the publisher and clawwallet.cc as a live software distribution source. Treat .env.clay, identity.json, AGENT_TOKEN, and CLAY_AGENT_TOKEN as secrets; do not paste or share them, and avoid exposing them in chat logs. Confirm every transaction manually, review any installer or upgrade before running it, and do not use the marketplace auto-install instructions unless you independently verify the fetched skill and command.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The documentation says policy cannot be changed via CLI/API, but then gives a `policy set` example. Contradictory security documentation can mislead reviewers and agents about whether spending limits or allowlists are mutable, which directly affects trust in wallet controls.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The wallet skill includes instructions to discover, fetch, and install unrelated marketplace skills from local and remote sources. That expands the skill from wallet management into a generic software acquisition and execution pathway, enabling unreviewed third-party code installation under the wallet skill's trust umbrella.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is presented as a wallet utility, but the documentation covers installation of arbitrary third-party skills from the network. This is a serious scope violation because a user approving a wallet workflow would not reasonably expect the skill to act as a general plugin installer.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The upgrade path downloads and executes a remote installer script before any local binary validation, which breaks the stated 'local sandbox' trust model. If the remote endpoint, DNS, TLS chain, or configurable base URL is compromised, an attacker can execute arbitrary code on the host and potentially access wallet material or agent secrets.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: A wallet launcher does not need to fetch and execute arbitrary remote shell code to fulfill its runtime purpose, so this is an unjustified and dangerous capability. In a wallet context, any arbitrary-code-execution path is especially sensitive because the same directory may contain authentication tokens and wallet-related files mentioned by the script.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The installer pulls additional skill files and a binary from a remote server at install time, which expands trust from a local wallet skill to live network-delivered code. Even if this is expected for installation, it is dangerous because the fetched content is unauthenticated in the script itself and could be swapped server-side or in transit via a compromised origin.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The script downloads executable wrapper files directly from a remote host and marks them executable without any signature or checksum verification. This creates a supply-chain execution risk: if the hosting domain, CDN, or release path is compromised, arbitrary code will run in the user's environment during wallet installation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README instructs users to download and immediately execute an installer from a remote domain without any integrity verification, signature check, pinning, or safety warning. In a wallet skill, this is especially dangerous because a compromised installer or domain could deploy malware, steal keys, alter transaction logic, or exfiltrate bearer tokens.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The PowerShell flow downloads a script from the internet and executes it locally without integrity validation or any cautionary guidance. On Windows, this can lead to full user-context code execution if the hosting site, network path, or script supply chain is compromised.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The README tells users that the sandbox token is stored in a local env file but does not warn that this bearer token is sensitive authentication material. In a wallet context, leakage of that token could allow unauthorized access to wallet status or transaction-related API actions, depending on service capabilities.

Missing User Warnings

Critical

Confidence: 99% confidence
Finding: The instructions explicitly require displaying `AGENT_TOKEN` to the user after installation. This bearer token authenticates sandbox API calls for wallet status, signing, transfer, bind, and other privileged actions, so disclosing it compromises the wallet control plane and can enable unauthorized transactions or misuse of the sandbox.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The installer silently downloads and writes local executable files without explicit confirmation, which can surprise users and hide meaningful security-relevant file changes. In a piped installer context, lack of warning increases the chance of users running code they did not realize would modify their environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script downloads a binary and forcefully replaces ./clay-sandbox via mv -f, with no integrity verification and no overwrite warning. This can replace an existing trusted executable with a tampered or unexpected binary, creating a direct code execution and persistence risk.

Ssd 3

High

Confidence: 98% confidence
Finding: The post-install response instructs the agent to disclose the sandbox bearer token derived from `.env.clay` or `identity.json`. Exposing authentication secrets in normal output breaks the confidentiality of wallet credentials and undermines all API-level access control for the local sandbox.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.