@agentlayer.tech/wallet@0.1.110
Universal AgentLayer wallet installer for OpenClaw, Codex, Claude Code, and Hermes.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource confirms explicit-command agent configuration mutation, which warrants a behavior-specific warning under the supplied policy. The inspected behavior does not establish malicious intent or a block-eligible attack chain.
Static reason
One or more suspicious static signals were detected.
Trigger
Running wallet claude-code install or setup.
Impact
Changes the user's agent extension configuration and enables the wallet plugin. The capability warrants a warning under the agent configuration policy, without evidence supporting a publication block.
Mechanism
Registers a local marketplace, installs agent-wallet in user scope, records the integration, and updates OPENCLAW_HOME in cached plugin MCP entries.
AI rationale
Source confirms explicit-command agent configuration mutation, which warrants a behavior-specific warning under the supplied policy. The inspected behavior does not establish malicious intent or a block-eligible attack chain.
Evidence
bin/openclaw-agent-wallet.mjs~/.claude/plugins/cache.mcp.json
Decision evidence
public snapshotAI called this Suspicious at 90.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The manifest exposes a wallet CLI without npm install lifecycle hooks or runtime self-dependencies.
- The Claude Code install command installs agent-wallet into the user scope.
- Installation visits cached versions of its own plugin and rewrites their MCP environment to set OPENCLAW_HOME.
- Agent configuration changes are activated by an explicit Claude Code CLI command.
- Universal installation prompts only on fresh detected installations in an interactive terminal; flags can bypass prompting.
Evidence against
- No covert credential export or malicious install hook was established.
- The inspected daemon helper checks service identity, vault location, listening PID, working directory, and ownership before stopping a process.
- The connector smoke helper installs test dependencies into a temporary directory with scripts disabled.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
5 flaggedconnectors/scripts/smoke-packed-packages.mjsView file
1import { execFileSync } from "node:child_process";
L2: import { createHash } from "node:crypto";
High
Child Process
Package source references child process execution.
connectors/scripts/smoke-packed-packages.mjsView on unpkg · L1bin/openclaw-agent-wallet.mjsView file
728const result = spawnSync("command", ["-v", name], {
L729: shell: true,
L730: stdio: "ignore",
High
3021target_version: packageVersion,
L3022: fix: `npm install --global ${packageJson.name}@${packageVersion}`,
L3023: };
...
L3025: const packageSpec = `${packageJson.name}@${packageVersion}`;
L3026: const result = spawnSync(
L3027: installed.npm_bin,
Findings
4 High4 Medium5 Low
HighChild Processconnectors/scripts/smoke-packed-packages.mjs
HighShellbin/openclaw-agent-wallet.mjs
HighSame File Env Network Executionbin/lib/evm-daemon.mjs
HighRuntime Package Installbin/openclaw-agent-wallet.mjs
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpersetup.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to @agentlayer.tech/wallet@0.1.110.
See all versions of @agentlayer.tech/wallet for other recorded verdicts.
- Review the evidence and your use of @agentlayer.tech/wallet@0.1.110 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.