ClawHub

Agent Wallet

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed wallet bridge, but it needs Review because it can move real crypto funds and has broad approval, mainnet, secret-storage, and auto-unlock behavior.

Only install this if you intend to let an OpenClaw agent operate a real wallet. Start on devnet/testnet or sign-only mode, avoid putting private keys or approval secrets in plugin config, keep sealed vault credentials tightly controlled, and require a fresh human confirmation before any mainnet execute. VirusTotal and the static scan were clean, so this is a Review classification based on high-impact wallet authority and scoping concerns, not evidence of malware.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The plugin claims execution should occur only after explicit user confirmation in chat, but the execute path can mint and attach an approval token solely from a cached preview tied to user/tool state. Because no fresh confirmation flag, nonce, or current-turn authorization is required, a later tool call in the same session can reuse stale approval context and trigger value-moving operations without a new affirmative action.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The recommended configuration sets `network` to `mainnet` and the surrounding guidance assumes live-wallet operation by default. In a wallet-managing agent skill, defaulting users toward mainnet increases the chance of irreversible financial actions during setup, testing, or accidental invocation, especially when the same README also advertises execution-capable transfer, swap, lending, and staking flows.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The manifest explicitly defines highly sensitive fields such as privateKey, masterKey, approvalSecret, and multiple API secrets in the plugin configuration. Although some are labeled deprecated/insecure and marked sensitive in UI hints, the schema still normalizes storing secrets in config, which can lead to accidental exposure through manifests, logs, backups, admin consoles, or agent misconfiguration. In a wallet plugin that can sign transactions and move funds, secret disclosure can directly enable wallet compromise or unauthorized approvals.

Session Persistence

Medium
Category
Rogue Agent
Content
- For a local official OpenClaw install, `userId` should represent the wallet owner for that agent install.
- The public OpenClaw plugin docs do not document a per-request end-user identifier in `registerTool(...).execute(...)`, so dynamic multi-user wallet selection is intentionally kept in the Python/runtime layer, not inside the TypeScript plugin itself.
- Helper scripts in `agent-wallet/scripts/` are generic patch/finalize utilities and no longer assume a specific local username, path, or temporary master key.
- The OpenClaw plugin API in this repo exposes tool registration, not host password prompts. EVM wallet create/unlock still is not a public agent tool, but the runtime can now auto-create or auto-unlock the local EVM wallet during `set_wallet_backend` or EVM tool calls when `sealed_keys.json` contains the local EVM vault password.
- For a one-command local BTC onboarding path, use `agent-wallet/scripts/bootstrap_openclaw_btc.py`, which both sets up the BTC wallet binding and patches local OpenClaw config for `backend=wdk_btc_local`.
- The BTC flow now only supports local service URLs (`127.0.0.1` / `localhost` / `::1`).
- The local BTC service is protected with a bearer token loaded from `~/.openclaw/wdk-btc-wallet/local-auth-token`, not from plugin config JSON.
Confidence
90% confidence
Finding
create or auto-unlock the local EVM wallet during `set_wallet_backend` or EVM tool calls when `sealed_keys.json` contains the local EVM vault password. - For a one-command local BTC onboarding path, u

VirusTotal

62/62 vendors flagged this plugin as clean.

View on VirusTotal