@agentlayer.tech/wallet@0.1.124
Universal AgentLayer wallet installer for OpenClaw, Codex, Cursor, Claude Code, and Hermes.
AI Security Review
scanned 13d ago · by lpm-firewall-aiThe manifest has no install lifecycle hook, and the flagged runtime behavior is tied to explicit CLI use. Telemetry is limited to command metadata sent to the package’s AgentLayer gateway; the other flagged files implement local plugin setup, guarded daemon shutdown, and a temporary test helper.
Decision evidence
public snapshot- The manifest exposes a user-run CLI and has no npm install lifecycle hook.
- CLI telemetry contains command and installation metadata, not raw arguments or wallet credentials; it is sent to the AgentLayer gateway.
- Claude Code plugin setup writes a local marketplace entry and is reached through the explicit install command.
- The daemon helper checks its takeover setting and process identity before signaling.
- The flagged connector script is a temporary package smoke-test helper.
Source & flagged code
6 flaggedPackage source references child process execution.
connectors/scripts/smoke-packed-packages.mjsView on unpkg · L1This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
bin/openclaw-agent-wallet.mjsView on unpkgFindings
Affected versions and remediation
This report applies to @agentlayer.tech/wallet@0.1.124.
See all versions of @agentlayer.tech/wallet for other recorded verdicts.
- Review the evidence and your use of @agentlayer.tech/wallet@0.1.124 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.