ClawHub
Back to skill

Security audit

Fuego

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for a Solana agent wallet, but it asks users to install mutable wallet software and operate a persistent hot wallet that can move real funds without enough scoping or consent guardrails.

Install only if you are comfortable reviewing or trusting the external fuego-cli code and using a low-balance dedicated Solana wallet. Pin and verify the package where possible, avoid mainnet until tested on devnet, require explicit human approval for every transfer/swap/purchase, and do not store meaningful funds or sensitive shipping data in this workflow without stronger isolation and privacy controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:23
Finding

Unpinned Third-Party Wallet Package with Mutable Installation and Update Channels

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–47 and 698–723
Vulnerability Type: Unpinned and unaudited third-party dependency installation
Risk Level: High

Vulnerable Code

bash
### 1. Install fuego-cli
npm install -g fuego-cli
bash
### 3. Install Fuego Project

**Prerequisites:** Rust 1.85+ and Cargo are required to build the server.

# For OpenClaw agents (auto-detects ~/.openclaw/workspace)
fuego install

# For manual installs (specify path)
fuego install --path ~/projects/fuego
bash
# Ensure all components are up to date
fuego update

# This updates both fuego-cli and the fuego project
# Restart server after updating: fuego serve

Technical Analysis

The Skill directs users to globally install fuego-cli without specifying an exact version or package integrity hash. It then delegates installation and updates of another project to commands implemented by that unreviewed package.

The audited artifact contains only SKILL.md; it does not include the source of the CLI or installed server. Consequently, the following security-sensitive behavior cannot be verified:

  • The source and integrity of components downloaded by fuego install and fuego update.
  • How the CLI reads and protects ~/.fuego/wallet.json.
  • Whether transaction recipients and amounts are preserved before signing.
  • Whether the installed localhost service is strictly bound to 127.0.0.1.
  • Whether x402 private-key handling and memory clearing match the documentation.
  • Whether updates are authenticated or protected against rollback and substitution.

Because npm package contents and the secondary project can change after this Skill is reviewed, the commands create a mutable supply-chain execution channel. Global installation also increases exposure by placing package executables in the user's command search path.

The finding does not establish that the current pack ...[truncated 1923 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin fuego-cli to an exact reviewed version instead of installing the mutable latest release:

    bash
    npm install -g fuego-cli@1.4.0

    The pinned version must correspond to a separately reviewed release.

  2. Publish and verify cryptographic integrity information for every installed artifact. Use npm lockfiles where applicable, registry integrity metadata, signed release manifests, and SHA-256 or stronger checksums obtained through an authenticated channel.

  3. Include the CLI and server source code in the audited Skill artifact, or reference an immutable source revision by full commit hash. Document every external artifact downloaded by fuego install and fuego update.

  4. Replace unrestricted self-update behavior with an explicit update process that:

    • Displays the current and target versions.
    • Verifies a trusted digital signature.
    • Requires informed user confirmation.
    • Rejects unsigned releases and unauthorized download origins.
    • Supports rollback to a known-good version.

  5. Avoid global npm installation where possible. Run the pinned package in an isolated environment with a restricted executable path and minimum filesystem permissions.

  6. Isolate wallet signing from installation and network-facing components. A narrowly scoped signer should validate the network, recipient, mint, amount, fees, and transaction instructions before authorizing a signature.

  7. Prevent installer and updater processes from reading wallet files. Apply operating-system sandboxing or separate user identities so software installation cannot access ~/.fuego/wallet.json or its backup.

  8. Independently verify and test the documented security claims, including localhost-only binding, absence of private-key transmission, authenticated update behavior, and x402 key lifecycle handling.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The x402 purchase flow requests sensitive personal data including email and full shipping address, but the documentation does not provide any privacy, retention, or transmission warning. This is dangerous because agents may collect and forward regulated personal data to third-party services without informed consent or data minimization controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill is described broadly as a local Solana wallet for transfers, swaps, and purchases, but does not define clear invocation boundaries, approval requirements, or safe defaults. For an autonomous agent skill that can move real crypto funds, this ambiguity can enable misuse or overbroad delegation of sensitive financial actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs creation of a persistent local wallet and backup files, establishing long-lived credential material for an agent-accessible workflow. In agent environments, persistent hot-wallet storage materially increases the risk of unauthorized later use, fund theft, or silent reuse by other processes if the host is compromised.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

npm install -g fuego-cli

text

### 2. Create Wallet
```bash
fuego create

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation presents transfer and swap commands on mainnet-beta as normal workflow without a prominent warning that they spend real assets. In agent settings, examples often become copied automation, so missing high-visibility warnings materially raises the risk of accidental irreversible loss of funds.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
**Security Model:**
- Private keys never leave your machine (client-side signing for all transfers)
- File permissions provide real security (chmod 600)
- No network key exposure (localhost-only server)
- Standard Solana format (compatible with CLI tools)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

Get the local wallet address dynamically.

bash
curl http://127.0.0.1:8080/wallet-address

Response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

POST /build-transfer-usdc - Build USDC Transfer

bash
curl -X POST http://127.0.0.1:8080/build-transfer-usdc \
  -H "Content-Type: application/json" \
  -d '{
    "network": "mainnet-beta",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 554)May include surrounding context.

POST /build-transfer-usdc - Build USDC Transfer

bash
curl -X POST http://127.0.0.1:8080/build-transfer-usdc \
  -H "Content-Type: application/json" \
  -d '{
    "network": "mainnet-beta",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs agents to invoke fuego via subprocess from application code, which broadens the execution surface beyond narrowly scoped wallet actions. In an agent context, shelling out to a globally installed CLI increases the risk of command injection, path hijacking, and uncontrolled fund-moving operations if any arguments are derived from untrusted input.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 528)May include surrounding context.

POST /build-transfer-sol - Build SOL Transfer

bash
curl -X POST http://127.0.0.1:8080/build-transfer-sol \
  -H "Content-Type: application/json" \
  -d '{
    "network": "mainnet-beta",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 636)May include surrounding context.

  1. File Permissions = Real Security
    bash
    # Wallet files are chmod 600 (user read/write only)
ls -la ~/.fuego/wallet.json
# -rw------- 1 user user 658 Feb 18 15:01 wallet.json

Session Persistence

Medium
Category
Rogue Agent
Confidence
77% confidence
Finding

The security section normalizes long-term storage of the wallet file protected primarily by file permissions. While permissions help, they do not eliminate the risk of persistent credential exposure in an agent workflow where local compromise, process impersonation, or accidental reuse can still lead to unauthorized signing.

Content

Scanner excerpt · SKILL.md (reported line 636)May include surrounding context.

  1. File Permissions = Real Security
    bash
    # Wallet files are chmod 600 (user read/write only)
ls -la ~/.fuego/wallet.json
# -rw------- 1 user user 658 Feb 18 15:01 wallet.json

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 637)May include surrounding context.

  1. File Permissions = Real Security
    bash
    # Wallet files are chmod 600 (user read/write only)
ls -la ~/.fuego/wallet.json
# -rw------- 1 user user 658 Feb 18 15:01 wallet.json

Static analysis

No suspicious patterns detected.