Is donald-jackson/agent-wallet-cli safe?
https://github.com/openclaw/skills/tree/main/skills/donald-jackson/agent-wallet-cli
The agent-wallet-cli skill definition files contain no active malicious code or prompt injection techniques, but the skill's design presents high operational risk: it explicitly instructs agents to bypass transaction confirmation (--yes) for crypto sends, x402 auto-payments, and token approvals, enabling irreversible financial actions without human oversight. The required external npm package was not audited and could contain malicious install-time code. Canary file reads observed post-install are attributable to the oathe audit system with no modification detected, and clone behavior was limited to expected GitHub traffic.
Category Scores
Findings (10)
CRITICAL Agent can send irreversible crypto transactions without human confirmation -55 ▶
The SKILL.md explicitly instructs agents to pass --yes to all send commands for non-TTY/agent use, bypassing the interactive confirmation prompt. In an agentic context, a single ambiguous user request, prompt injection from external content, or misinterpretation could cause the agent to transfer arbitrary amounts of ETH/SOL/tokens to any address with no opportunity for user review before the transaction is broadcast.
HIGH x402 auto-payment enables funds drain via attacker-controlled HTTP endpoints -40 ▶
The x402 command instructs the agent to make HTTP requests, detect 402 Payment Required responses, and automatically pay the requested amount in stablecoins before retrying. With --yes, the agent pays without confirmation. An attacker-controlled URL (reachable via web-browsing or fetch skills, or injected via prompt injection) can serve a 402 response demanding any amount up to --max-amount, silently draining funds.
HIGH Unaudited external npm package required for operation -35 ▶
The skill requires npm install -g agent-wallet-cli, an external package not audited in this scan. npm packages can execute arbitrary code via preinstall/postinstall lifecycle hooks. The published npm package may differ from the GitHub source referenced in the skill, and the package contents were not analyzed for malicious behavior during this audit.
HIGH Unlimited ERC-20 token approvals grantable by agent -30 ▶
The approve --amount unlimited command allows the agent to permanently grant unlimited spending allowances on any ERC-20 token to any spender address. This is an irreversible on-chain operation that could be exploited if the agent is tricked into approving an attacker-controlled contract address.
HIGH RPC endpoint can be overridden to attacker-controlled node -25 ▶
The skill documents a networks --set command that allows overriding the RPC URL for any chain/network. An attacker who can influence agent behavior could redirect all blockchain queries to a malicious node that manipulates transaction data, reports false balances, or performs man-in-the-middle attacks on transaction broadcast.
MEDIUM Canary files accessed post-install (probable audit system activity) -27 ▶
Six sensitive canary files were opened for read at timestamp 1771933622.442, after the skill was installed and oathe analysis scripts had run. While no modification occurred and canary integrity passed, the second read event cannot be conclusively attributed to oathe's own verification scan without process-level attribution. The timing is consistent with oathe's post-install scan but warrants noting.
MEDIUM Skill design systematically bypasses transaction confirmation for agent use -28 ▶
The SKILL.md documents that --yes is required for agent/non-TTY use across all mutating operations (send, approve, transfer-from, x402). This is not a bug but an intentional design that removes human oversight from financial operations. When injected into an agent system prompt, this design guidance makes the agent a confirmation-free transaction executor by default.
MEDIUM WALLET_PASSWORD exposure via environment variable and CLI flag -20 ▶
The skill documents passing WALLET_PASSWORD via environment variable and --password CLI flag. CLI arguments are visible in /proc/
LOW Pre-existing outbound TLS connection to Canonical infrastructure -18 ▶
A TLS connection to 185.125.188.57:443 (Canonical/Ubuntu) was present before the clone and absent after. This appears to be Ubuntu's MOTD news service or package update checker, not related to the skill. Noted for completeness.
INFO No malicious code in skill definition files 0 ▶
SKILL.md and _meta.json contain only documentation and metadata. No executable code, hidden instructions, git hooks, submodules, or symlinks were detected in the cloned skill files.