📦
Audit History
agent-wallet - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 02:25 AM
Static detections are documentation and Markdown false positives; the file does not contain executable shell, network, or secret-exfiltration behavior. Two design risks remain: policy allowlists are permissive when omitted, and the local dashboard token is printed in tool output. Review the implementation separately before funding a wallet.
1
Files scanned
248
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (2)
Medium
Permissive policy fields when unset
The policy reference states that unset allowedChains and allowedToAddresses permit any chain or address. An administrator who disables the kill switch without setting these controls can unintentionally authorize broad transfers.
The documented behavior explicitly defines permissive defaults for the relevant allowlists, creating a clear configuration-risk path.
Medium
Dashboard admin token exposed in tool output
The dashboard token is printed in tool output, which can place a policy-management credential in the agent conversation. Localhost binding limits exposure, but the token should remain outside model-visible output.
The documentation explicitly says the token is printed in tool output; the resulting exposure is mitigated, but not eliminated, by the localhost-only endpoint.
Risk Factors
⚙️ External commands (50)
SKILL.md:14 SKILL.md:17 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:33-37 SKILL.md:37-43 SKILL.md:43-48 SKILL.md:48-50 SKILL.md:50 SKILL.md:58-59 SKILL.md:59-61 SKILL.md:61 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73 SKILL.md:77 SKILL.md:81-100 SKILL.md:100-106 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:109 SKILL.md:110 SKILL.md:111 SKILL.md:112 SKILL.md:113-114 SKILL.md:114 SKILL.md:115 SKILL.md:121 SKILL.md:123-128 SKILL.md:128-132 SKILL.md:132-141 SKILL.md:141-144 SKILL.md:144 SKILL.md:145-159 SKILL.md:159-165 SKILL.md:165-167 SKILL.md:167-171 SKILL.md:171-176 SKILL.md:176-182 SKILL.md:182-184 SKILL.md:184-186 SKILL.md:186 SKILL.md:193-200 SKILL.md:200-203
🌐 Network access (5)
📁 Filesystem access (10)
Audited by: claude
Jul 9, 2026, 11:33 PM
Most shell-execution alerts are false positives caused by Markdown code spans, not executable Ruby or shell code. The skill still has high-impact wallet behavior: local keystore and policy files, transaction signing, a localhost admin dashboard, and passphrase export guidance. Publish only with strong warnings and after the author removes risky secret-exposure guidance and reconciles unsupported-feature claims.
1
Files scanned
248
Lines analyzed
29
Review items
0
False positives ignored
Confirmed security concerns (5)
Critical
macOS security command
> **Back up the passphrase either way.** Keychain entry: `service=chaingpt-mcp-agent-wallet account=
The documentation provides a macOS security command that prints the wallet passphrase from Keychain. This may be legitimate backup guidance, but it can expose a high-impact wallet secret.
High
Crypto seed/private key mention
| `~/.chaingpt-mcp/agent-wallet/keystore.json` | AES-256-GCM encrypted private key | Generated once
The skill explicitly stores an encrypted private key in a local keystore file. That is expected for a wallet, but compromise of the key can lead to fund loss.
High
Agent Wallet Can Sign and Broadcast Transactions
The skill documents a signing tool as the only tool that can move funds and shows a pre-flight flow ending in transaction signing. Policy gates reduce risk, but the intended capability can transfer real crypto assets.
The document explicitly states the signing tool signs and broadcasts transactions and can move funds. The cited pre-flight checklist shows it as the final operational step.
High
Local Dashboard Can Modify Wallet Policy
The dashboard is described as authenticated and localhost-only, but it can edit the policy JSON and toggle the kill switch. A compromised token or local session could weaken or disable wallet guardrails.
The file states the dashboard returns an admin token, includes a policy editor, and exposes POST routes for policy and kill-switch changes. These are clear administrative mutation paths.
Medium
Contradictory Support Claims for Solana and ERC-4337
The document presents Solana and ERC-4337 workflows, then later says non-EVM signing and session keys are not supported or are future features. This can mislead users about which signing surfaces are implemented and safe to use.
The same file contains detailed Solana and ERC-4337 sections and a later limitation section that denies those capabilities. The conflict is directly visible in the cited ranges.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Ruby/shell backtick execution
| `chaingpt_agent_wallet_sign_and_send` | **Signs + broadcasts a tx** | The only tool that can move
This Markdown table documents a tool that signs and broadcasts transactions, which can move wallet funds if policy permits. It is not Ruby backtick execution, but the referenced capability is security-sensitive.
High
Ruby/shell backtick execution
Returns a `http://127.0.0.1:8787` URL **and a one-time admin token** printed in the tool output (als
This Markdown line documents a one-time admin token printed by the dashboard tool and saved to a hidden file. It is not Ruby backtick execution, but the token controls sensitive wallet administration.
High
Ruby/shell backtick execution
- **Policy JSON editor** — full inline editor, validated server-side, atomic write with `.bak` backu
This Markdown line documents a policy editor that can write wallet policy changes. It is not Ruby backtick execution, but policy mutation can alter spending controls.
High
Ruby/shell backtick execution
| `POST /api/policy` | save new policy after validation | requires session + Origin |
This endpoint entry documents POST policy writes from the dashboard. It is not Ruby backtick execution, but the capability can change wallet guardrails.
High
Hidden file in home directory
| `~/.chaingpt-mcp/agent-wallet/keystore.json` | AES-256-GCM encrypted private key | Generated once
The skill documents a hidden home-directory keystore containing an encrypted private key. This is intended behavior, but it is security-sensitive wallet material.
High
Hidden file in home directory
| `~/.chaingpt-mcp/agent-wallet/policy.json` | Plain JSON rules | **You, the admin, with a text edit
The skill documents a hidden home-directory policy file that controls wallet signing rules. Unauthorized edits could change spending limits or destination controls.
High
Hidden file in home directory
Both default to `~/.chaingpt-mcp/agent-wallet/` but can be overridden via `CHAINGPT_KEYSTORE_FILE` a
The skill documents hidden default wallet paths with environment-variable overrides. These paths control where sensitive keystore and policy files are loaded.
High
Hidden file in home directory
Returns a `http://127.0.0.1:8787` URL **and a one-time admin token** printed in the tool output (als
The skill documents saving a dashboard admin token under a hidden home-directory path. Compromise of that token can expose administrative wallet controls.
High
Hidden file in home directory
- Default paths: `~/.chaingpt-mcp/agent-wallet/{keystore.json,policy.json}` (override via env).
The reference section confirms hidden default paths for keystore and policy storage. These files are core wallet security state and require strict permissions.
High
Hidden file access
| `~/.chaingpt-mcp/agent-wallet/keystore.json` | AES-256-GCM encrypted private key | Generated once
The skill documents a hidden home-directory keystore containing an encrypted private key. This is intended behavior, but it is security-sensitive wallet material.
High
Hidden file access
| `~/.chaingpt-mcp/agent-wallet/policy.json` | Plain JSON rules | **You, the admin, with a text edit
The skill documents a hidden home-directory policy file that controls wallet signing rules. Unauthorized edits could change spending limits or destination controls.
High
Hidden file access
Both default to `~/.chaingpt-mcp/agent-wallet/` but can be overridden via `CHAINGPT_KEYSTORE_FILE` a
The skill documents hidden default wallet paths with environment-variable overrides. These paths control where sensitive keystore and policy files are loaded.
High
Hidden file access
Returns a `http://127.0.0.1:8787` URL **and a one-time admin token** printed in the tool output (als
The skill documents saving a dashboard admin token under a hidden home-directory path. Compromise of that token can expose administrative wallet controls.
High
Hidden file access
- Default paths: `~/.chaingpt-mcp/agent-wallet/{keystore.json,policy.json}` (override via env).
The reference section confirms hidden default paths for keystore and policy storage. These files are core wallet security state and require strict permissions.
Medium
Ruby/shell backtick execution
| `chaingpt_agent_wallet_serve_ui` | Starts a local HTTP server | Dashboard on `http://127.0.0.1:878
This Markdown table documents starting a localhost HTTP dashboard. The loopback binding limits exposure, but it still creates an administrative network surface.
Medium
Ruby/shell backtick execution
| `POST /api/killswitch` | toggle the kill switch (set=on/off) | requires session + Origin |
This endpoint entry documents a kill-switch POST action. It is not Ruby backtick execution, but changing the kill switch affects whether signing is allowed.
Medium
Hardcoded URL
| `chaingpt_agent_wallet_serve_ui` | Starts a local HTTP server | Dashboard on `http://127.0.0.1:878
The skill documents a localhost HTTP dashboard on 127.0.0.1:8787. Loopback reduces remote exposure, but this is still a real local administrative network surface.
Medium
Hardcoded URL
Returns a `http://127.0.0.1:8787` URL **and a one-time admin token** printed in the tool output (als
The skill documents a localhost HTTP dashboard on 127.0.0.1:8787. Loopback reduces remote exposure, but this is still a real local administrative network surface.
Medium
Hardcoded IP address
| `chaingpt_agent_wallet_serve_ui` | Starts a local HTTP server | Dashboard on `http://127.0.0.1:878
The skill documents a localhost HTTP dashboard on 127.0.0.1:8787. Loopback reduces remote exposure, but this is still a real local administrative network surface.
Medium
Hardcoded IP address
Returns a `http://127.0.0.1:8787` URL **and a one-time admin token** printed in the tool output (als
The skill documents a localhost HTTP dashboard on 127.0.0.1:8787. Loopback reduces remote exposure, but this is still a real local administrative network surface.
Medium
Hardcoded IP address
7. **Bound to `127.0.0.1` only.** Never on `0.0.0.0` — the dashboard is not reachable from other mac
The text states the dashboard is bound to 127.0.0.1 rather than 0.0.0.0. This is a safer configuration, but it confirms a local server binding that must stay restricted.
Risk Factors
⚙️ External commands (50)
SKILL.md:14 SKILL.md:17 SKILL.md:20 SKILL.md:28 SKILL.md:29 SKILL.md:33-37 SKILL.md:37-43 SKILL.md:43-48 SKILL.md:48-50 SKILL.md:50 SKILL.md:58-59 SKILL.md:59-61 SKILL.md:61 SKILL.md:67-68 SKILL.md:68-69 SKILL.md:69-70 SKILL.md:70-71 SKILL.md:71-72 SKILL.md:72-73 SKILL.md:73 SKILL.md:77 SKILL.md:81-100 SKILL.md:100-106 SKILL.md:106 SKILL.md:107 SKILL.md:108 SKILL.md:109 SKILL.md:110 SKILL.md:111 SKILL.md:112 SKILL.md:113-114 SKILL.md:114 SKILL.md:115 SKILL.md:121 SKILL.md:123-128 SKILL.md:128-132 SKILL.md:132-141 SKILL.md:141-144 SKILL.md:144 SKILL.md:145-159 SKILL.md:159-165 SKILL.md:165-167 SKILL.md:167-171 SKILL.md:171-176 SKILL.md:176-182 SKILL.md:182-184 SKILL.md:184-186 SKILL.md:186 SKILL.md:193-200 SKILL.md:200-203
🌐 Network access (5)
📁 Filesystem access (10)
Detected Patterns
macOS security command
Audited by: codex