ClawHub
Back to skill

Security audit

zetrix-agentic-wallet

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for a Zetrix wallet, but its onboarding path can route a sensitive HSM wallet password through the agent despite saying secrets must never be handled in chat.

Review before installing. This skill is designed to control a real wallet and may spend real funds when configured, so keep MAX_PAYMENT_AMOUNT low and use testnet unless mainnet is intended. Do not paste HSM passwords or private keys into chat; account creation should be handled through an out-of-band setup flow or secret store, not by giving the agent a password.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill repeatedly states that the HSM password must never be requested or handled in chat, but the onboarding flow later instructs the agent to have the user choose a password and pass it into `create_holder_account`. That creates a direct secret-handling path through the model, undermines the earlier safety guarantees, and exposes a highly sensitive credential to prompt logs, model context, and possible exfiltration via other tools or prompt injection.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger condition includes a broad catch-all based on any mention of wallet/payment/credential-related terms, which can cause the skill to activate in contexts where the user did not intend wallet operations. In a skill that can prove identity, mint accounts, and spend funds, overbroad activation increases the chance of inappropriate tool use, prompt-injection-driven invocation, or accidental escalation into sensitive financial actions.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.