📦
Historial de auditorías
openclaw-agent-wallet - 1 auditoría
Versión de auditoría 1 Más reciente
2 nov 2026, 12:27
All ten static detections are false positives involving Markdown, attribution links, or protective discussion of private keys. The guide mischaracterizes URL-based external signing as air-gapped, without demonstrating offline isolation. No evidence found of executable payloads, credential collection, exfiltration, or prompt injection in the reviewed file.
1
Archivos escaneados
90
Líneas analizadas
3
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (1)
Medio
Networked Signing Mischaracterized As Air-Gapped
The guide calls URL-based external signing "Air-Gapped Signing" and claims isolation through a dedicated URL. External key custody alone does not establish an offline boundary; this wording can lead users to overestimate protection when deploying wallets.
Both passages explicitly equate a signer URL with air-gapped isolation. No offline transfer mechanism is documented; this confirms misleading guidance, not an observed signer compromise.
Factores de riesgo
⚙️ Comandos externos (2)
🌐 Acceso a red (2)
Auditado por: codex