Is jameslawton/sequence-cli safe?

Every command that requires wallet authentication passes the private key via the -k flag as a plaintext command-line argument. Process arguments are readable from /proc//cmdline by any process with the same UID, are captured in shell history files, appear in audit logs, and may be logged by monitoring software. A 64-character hex private key exposed this way grants full control over all associated wallets.

The transfer command enables an AI agent to sign and broadcast ERC20 token transfers on multiple EVM blockchains. Blockchain transactions are cryptographically final — there is no chargeback, undo, or recovery mechanism. Agent errors in recipient address parsing, hallucinated amounts, or successful prompt injection attacks result in permanent loss of user funds. The skill's design assumes careful human review of each transfer, which is structurally incompatible with autonomous agent execution.

Any agent with this skill active and a funded Sequence wallet represents a high-value prompt injection target. Malicious instructions embedded in user-provided documents, web pages fetched by the agent, or other skills' outputs could issue transfer commands to attacker-controlled addresses. The access key is likely stored in agent context or ~/.sequence-builder/config.json after setup, meaning the attacker needs only to specify a recipient address and amount. Combined with a file-reading skill, the config file can be read to obtain the access key without the user ever providing it again.

The skill's mechanism is to invoke npx @0xsequence/builder-cli, which fetches the npm package at runtime (or uses a cached version) and executes it with full user-level permissions. This creates a supply chain dependency: a compromised npm account, malicious dependency update, typosquatting attack, or dependency confusion attack against the @0xsequence scope could result in arbitrary code execution. The downloaded code receives private keys as arguments and runs unsandboxed with access to the user's entire home directory including ~/.ssh, ~/.aws, and ~/.gnupg.

The @0xsequence/builder-cli npm package receives cryptocurrency private keys as command arguments, processes them to derive wallet addresses, sign transactions, and authenticate with the Sequence Builder API. While 0xsequence is a known blockchain infrastructure company and the package appears legitimate, the private key handling occurs entirely within externally-controlled npm code. Any version of the package that adds telemetry, logging, or an outbound HTTP call with the private key would silently exfiltrate all wallet funds without detection at the skill layer.

The CLI stores JWT authentication tokens and optionally AES-encrypted private keys in ~/.sequence-builder/config.json. This file is owned by the user but accessible to any process running under the same UID. In an agent environment where multiple skills, tools, or subprocesses share a user account, this credential store becomes a shared secret visible to all components. The SEQUENCE_PASSPHRASE environment variable, which decrypts the stored private key, is also inherited by all child processes of the agent.

The login command accepts --api-url and --env flags, allowing the authenticated API endpoint to be overridden. If an agent is manipulated via prompt injection to authenticate against a malicious URL, the private key submitted during the login handshake could be intercepted by an attacker-controlled server masquerading as the Sequence Builder API. This is a secondary risk requiring a prompt injection precondition but represents a complete credential compromise if triggered.

When an AI agent uses this skill, private keys may appear in the agent's reasoning traces, tool call arguments, or response text if the agent quotes or repeats command outputs. Many agent frameworks log reasoning and tool calls to disk or ship them to cloud services. A private key appearing in a log file or cloud telemetry system constitutes a permanent credential leak.

Installation performed a clean sparse git clone from the official openclaw/skills repository on GitHub (140.82.121.4). No unexpected process spawning, no connections to non-GitHub hosts, no filesystem writes outside the skill directory. Ubuntu infrastructure connections (185.125.x.x) observed are standard system-level activity unrelated to the skill.

Honeypot files simulating .env, SSH private key, AWS credentials, .npmrc, Docker config, and GCloud application credentials were all confirmed intact after installation. inotifywait events showing these files opened at 08:51:26 predate the skill installation (git clone began at 08:51:32) and correspond to the audit framework's own canary setup routine. The second set of auditd PATH events at audit(1771923104) matches the post-install verification scan pattern.