ClawHub
Back to skill

Security audit

Solana Wallet Rpc

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Solana wallet helper with local key storage and an explicit RockPaperClaw deposit path; it is not deceptive, but key handling and installation should be treated as security-sensitive.

Use this skill only with wallets you are comfortable exposing to a local script. Prefer devnet or a dedicated low-value wallet, set an explicit SOLANA_WALLET_KEYPAIR for sensitive actions, inspect the RockPaperClaw deposit preview before rerunning with --execute, and avoid mainnet or large balances unless you have pinned and reviewed dependencies with a lockfile.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:6
Finding

Mutable npm Dependency Resolution Without a Lockfile

Content
View full analysis

Vulnerability Details

File Location: package.json:6-10
Vulnerability Type: Supply-chain risk caused by mutable dependency versions
Risk Level: Medium

Vulnerable Code

json
"dependencies": {
  "@solana/spl-token": "^0.4.13",
  "@solana/web3.js": "^1.98.4",
  "bs58": "^6.0.0",
  "tweetnacl": "^1.0.3"
}

The installation instructions in SKILL.md:48-51 direct users to perform a non-reproducible installation:

bash
cd skills/solana-wallet-rpc
npm install

Technical Analysis

All four dependencies use caret version ranges. These ranges permit npm to install newer compatible releases than those visible during this audit. The project also has no committed lockfile, so direct and transitive dependency versions and integrity hashes are not fixed.

Consequently, future installations may execute dependency code that was not part of the reviewed artifact. npm package installation can also invoke lifecycle scripts unless they are explicitly disabled. This is particularly sensitive because the application handles Solana private-key files and signs messages and transactions.

This finding does not establish that any currently declared package is malicious. The vulnerability is the absence of reproducible, integrity-controlled dependency resolution.

Attack Path

  1. An attacker compromises the npm account, release pipeline, or transitive dependency of a package allowed by the declared version ranges.
  2. The attacker publishes a malicious version that satisfies one of the caret ranges.
  3. A user follows the documented npm install command.
  4. npm resolves the malicious direct or transitive package because no lockfile fixes the audited dependency graph.
  5. Malicious code executes through an installation lifecycle script or when the wallet script imports the package.
  6. The code runs with the privileges of the user performing installation or invoking the wallet utility and may search for or read wallet files accessible to that account ...[truncated 661 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace caret ranges with reviewed exact versions, for example:

    json
    "dependencies": {
  "@solana/spl-token": "0.4.13",
  "@solana/web3.js": "1.98.4",
  "bs58": "6.0.0",
  "tweetnacl": "1.0.3"
}

  2. Generate, review, and commit a package-lock.json so direct and transitive versions and integrity hashes are fixed.

  3. Change installation documentation from npm install to npm ci, which enforces the committed lockfile.

  4. Use npm ci --ignore-scripts if none of the required packages need lifecycle scripts. If scripts are required, review and explicitly allow only necessary scripts.

  5. Run dependency vulnerability, provenance, and integrity checks in CI.

  6. Review lockfile changes as security-sensitive changes and use automated dependency updates with controlled testing rather than unrestricted resolution during installation.

  7. Install and run the utility under a least-privileged account with access only to the specific wallet needed for the requested operation.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script implements a fund-moving rockpaperclaw-deposit command that can transfer USDC by constructing and submitting a transaction when --execute is provided. This exceeds the portable wallet operations described in the skill metadata and creates a hidden spending path inside a skill that users may reasonably expect to handle only wallet creation, balance checks, airdrops, and message signing.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill describes use of environment variables such as SOLANA_WALLET_KEYPAIR, SOLANA_RPC_URL, and overwrite flags, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, undeclared environment access can expose secrets or allow the skill to operate on unexpected wallets or networks, especially because the skill also handles private key material and signing.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
73% confidence
Finding

The skill intentionally creates, loads, and reuses local Solana keypair files across sessions, which introduces persistent secret material on disk. That persistence increases the blast radius of compromise: another skill, process, or user on the same system could access the wallet file and use it for unauthorized signing or fund movement, especially since the skill supports message signing and optional transaction execution.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
It can:

- create or load a local Solana wallet
- print the wallet address
- check SOL balance
- request a devnet SOL airdrop

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The hardcoded RockPaperClaw program ID, USDC mint, and discriminator embed application-specific transfer logic into what is presented as a generic wallet utility. This kind of hidden specialization increases the risk that an agent or user invokes behavior they did not intend, especially because it is tied to a concrete external protocol capable of moving assets.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/solana_wallet.cjs (reported line 71)May include surrounding context.

js
} catch {}
  }
  console.error('No Solana keypair file found.');
  console.error('Set SOLANA_WALLET_KEYPAIR to a 64-byte keypair JSON file, create one with `create-wallet`, or place one in a common default path such as ~/.config/solana/id.json');
  process.exit(1);
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range, which allows newer minor/patch releases to be installed without explicit review. In a wallet/signing skill, this increases supply-chain risk because dependency changes can affect cryptographic handling or introduce malicious code unexpectedly.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Runtime dependencies for the solana-wallet-rpc OpenClaw skill",
  "type": "commonjs",
  "dependencies": {
    "@solana/spl-token": "^0.4.13",
    "@solana/web3.js": "^1.98.4",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

The unpinned @solana/web3.js dependency is a real supply-chain risk, and it is more concerning here because this package is central to wallet operations and signing workflows. Since the manifest allows version drift, builds could resolve to a release with security issues or even a compromised publication, affecting key material, signatures, or availability.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"type": "commonjs",
  "dependencies": {
    "@solana/spl-token": "^0.4.13",
    "@solana/web3.js": "^1.98.4",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }

Unverifiable Dependency: @solana/web3.js has 3 known advisory(ies) (CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability ); CVE-2024-54134 (Modified package published to npm, containing malware that exfiltrates private k); MAL-2024-11183 (Malicious code in @solana/web3.js (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
98% confidence
Finding

This finding is valid because @solana/web3.js has multiple known advisories, including malware-related reports, and the manifest does not pin a version, making it impossible to verify whether the installed artifact is safe. In a Solana wallet skill, this is especially dangerous because the affected library sits on the path for wallet creation, network interaction, and potentially handling sensitive signing operations.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

Using a caret range for bs58 permits unreviewed updates at install time. While this is a common package-management practice, in a wallet-related skill even utility libraries involved in encoding signatures and addresses should be tightly controlled to reduce supply-chain tampering risk.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"dependencies": {
    "@solana/spl-token": "^0.4.13",
    "@solana/web3.js": "^1.98.4",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

tweetnacl is a cryptographic dependency, so allowing version drift through a caret range is risky in a skill that signs Ed25519 messages. Any compromised or flawed update could directly affect signature correctness, secrecy of key material, or trust in ownership proofs.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"@solana/spl-token": "^0.4.13",
    "@solana/web3.js": "^1.98.4",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }
}

Static analysis

No suspicious patterns detected.