Skills/ClawHub/aawp-ai

aawp-ai@2.0.0

CAUTION· install only

Publisher claims: "AAWP (AI Agent Wallet Protocol) — the only crypto wallet protocol built exclusively for AI Agents on EVM-compatible blockchains and Solana. Not for humans. The signer is the AI Agent itself, cryptographically bound at wallet creation. Supports wallet lifecycle management, token transfers, DEX swaps, cross-chain bridging, Solana native trading (Pump.fun SDK + Jupiter), token launches, DCA automation, and price alerts." Observed in sandbox: calls raw.githubusercontent.com only, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher wfce · publishing for 249 daysInstalls 1,067Last detonated 7d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-07 and scored it 79/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Destructive file system command detected; Financial transfer language. Summary: calls raw.githubusercontent.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.1snetworkCONNECT https://raw.githubusercontent.com · undeclared
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexec /usr/bin/curl
0.1sprocessexited 22: curl: (22) The requested URL returned error: 403
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.2snetworkCONNECT https://raw.githubusercontent.com · undeclared
0.2sprocessexec /usr/bin/faketime
0.2sprocessexec /usr/bin/dirname
0.2sprocessexec /usr/bin/mkdir
0.2sprocessexec /usr/bin/curl
0.2sprocessexited 22: curl: (22) The requested URL returned error: 403

Static findings

HIGH
Access to sensitive file pathsscripts/wallet-manager.js:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filestry { const p = require('path'); require('fs').readFileSync(p.join(__dirname, '..', '.env'), 'utf8').split('\n').forEach(l => { const [k,...v] = l.split('='); if (k && !process.env[k.trim()]) process.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Process kill commandscripts/restart-daemon.sh:14 · Process kill command — agent can terminate processes# Only kill if it's actually running from the aawp skill dirFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/restart-daemon.sh:16 · Process kill command — agent can terminate processeskill "$pid" 2>/dev/nullFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/provision.sh:110 · Destructive file system command detectedrm -f /tmp/aawp.log /tmp/aawp-start.out /tmp/aawp-ensure.out # clear old logsFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Financial transfer languageSKILL.md:80 · Financial transfer language — potential advance-fee scamThe only crypto wallet protocol built exclusively for AI Agents. Not for humans.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandscripts/provision.sh:219 · Process kill command — agent can terminate processesif ! kill -0 "$DAEMON_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/deploy-clanker.js:230 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Sending via AAWP wallet ${walletAddr}...`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Access to sensitive file pathsscripts/wallet-manager.js:27 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files// Load .env for AAWP_WALLET pin and other configFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/bootstrap.sh:66 · File permission modification command — agent changes file ownership/permissionschmod +x "$NODE_FILE" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Financial transfer languageSKILL.md:5 · Financial transfer language — potential advance-fee scamAAWP (AI Agent Wallet Protocol) — the only crypto wallet protocol built exclusivelyFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandscripts/provision.sh:90 · Process kill command — agent can terminate processeskill "$pid" 2>/dev/null || trueFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionscripts/wallet-manager.js:528 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('Usage: wallet-manager [--chain <chain>] send-token <TOKEN|0xAddr> <to> <amount>');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/swap.js:361 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' ✅ Signature posted');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/wallet-manager.js:505 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Sending ${amount} ${chain.nativeCurrency} on ${chain.name}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
LOW
Financial transfer languageREADME.md:32 · Financial transfer language — potential advance-fee scam · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileAAWP is the first crypto wallet protocol where **only AI Agents can be the signer** — not humans, not companies, not the protocol itself. This is enforced at the contract level, not a policy.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandscripts/restart-daemon.sh:55 · Process kill command — agent can terminate processesif ! kill -0 "$DAEMON_PID" 2>/dev/null; thenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Financial transfer languageREADME.md:9 · Financial transfer language — potential advance-fee scam · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileThe only crypto wallet protocol built exclusively for AI Agents.<br>Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionscripts/transfer-token-raw.js:33 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Sending: ${RAW_AMOUNT.toString()} to ${TO}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/swap.js:469 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` You send: ${amtIn} ${symIn} (${fromChain.toUpperCase()})`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/wallet-manager.js:567 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Sending ${amount} ${sym} on ${chain.name}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/wallet-manager.js:494 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` Need: ${ethers.formatEther(sendAmt + MIN_WALLET_BAL)} (incl. reserve)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/wallet-manager.js:474 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('Usage: wallet-manager [--chain <chain>] send <to> <amount>');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈6,580 tok
1 file · 38 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

1 point to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim wfce: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim wfcePropose a patch to the maintainer