@agentlayer.tech/wallet
Universal AgentLayer wallet installer for OpenClaw, Codex, Cursor, Claude Code, and Hermes.
This report shows the evidence for @agentlayer.tech/wallet@0.1.142. 0 of 37 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 17h ago · by lpm-firewall-aiThe CLI sends undisclosed usage telemetry by default, including a persistent install identifier and command details. This fits the warning-level telemetry category; the reviewed payload does not show credential or file collection.
Static reason
One or more suspicious static signals were detected.
Trigger
Running a CLI command that uses the telemetry wrapper; collection is enabled by default and can be disabled with AGENT_WALLET_NO_TELEMETRY.
Impact
The vendor can associate repeated command usage with a persistent installation identifier. No credentials or user files were identified in the event fields.
Mechanism
The CLI writes command events to a local spool and asynchronously POSTs them to /v1/telemetry. Events contain a persistent install ID and command, host, version, result, timestamp, and source fields.
AI rationale
The CLI sends undisclosed usage telemetry by default, including a persistent install identifier and command details. This fits the warning-level telemetry category; the reviewed payload does not show credential or file collection.
Evidence
bin/openclaw-agent-wallet.mjs~/.openclaw/telemetry_spool.jsonl~/.openclaw/telemetry_id~/.openclaw/telemetry_last_flush
Network endpoints1
agent-layer-production.up.railway.app/v1/telemetry (default; gateway configurable via PROVIDER_GATEWAY_URL)
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- CLI commands record telemetry by default unless AGENT_WALLET_NO_TELEMETRY is set.
- Events include a persistent install ID, host, package version, command, result, timestamp, and install source.
- The CLI posts queued events to the telemetry endpoint on the configured provider gateway; the default gateway is the AgentLayer service.
Evidence against
- The manifest exposes the wallet installer as a command-line binary and declares no lifecycle scripts.
- The reviewed telemetry fields do not include credentials, environment values, local paths, or file contents.
- The package documents a separate background update check and provides an opt-out for that check.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
5 flaggedconnectors/scripts/smoke-packed-packages.mjsView file
1import { execFileSync } from "node:child_process";
L2: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
connectors/scripts/smoke-packed-packages.mjsView on unpkg · L1bin/openclaw-agent-wallet.mjsView file
740const result = spawnSync("command", ["-v", name], {
L741: shell: true,
L742: stdio: "ignore",
High
3079target_version: packageVersion,
L3080: fix: `npm install --global ${packageJson.name}@${packageVersion}`,
L3081: };
...
L3083: const packageSpec = `${packageJson.name}@${packageVersion}`;
L3084: const result = spawnSync(
L3085: installed.npm_bin,
Findings
4 High4 Medium5 Low
HighChild Processconnectors/scripts/smoke-packed-packages.mjs
HighShellbin/openclaw-agent-wallet.mjs
HighSame File Env Network Executionbin/lib/evm-daemon.mjs
HighRuntime Package Installbin/openclaw-agent-wallet.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpersetup.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @agentlayer.tech/wallet@0.1.142.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @agentlayer.tech/wallet@0.1.142 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.