skills/0xsequence-demos/openclaw-ecosystem-wallet-skill/sequence-ecosystem-wallet/Gen Agent Trust Hub
sequence-ecosystem-wallet
Fail
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: CRITICALEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and interacts with the domain
https://acme-wallet.ecosystem-demo.xyz, which is explicitly flagged as malicious by security scanners. It also utilizes a Cloudflare Worker athttps://moltbot-ecosystem-wallet.taylanpince.workers.devfor session management. - [COMMAND_EXECUTION]: The skill requires the execution of various Node.js scripts (
seq-eco.mjsandtrails.mjs) found within the workspace to perform sensitive operations like token swaps and balance checks on the Polygon network. - [CREDENTIALS_UNSAFE]: The instructions require the user to provide several sensitive API keys via environment variables, specifically
SEQUENCE_PROJECT_ACCESS_KEY,SEQUENCE_INDEXER_ACCESS_KEY, andTRAILS_API_KEY, which are necessary for the wallet's functionality. - [DATA_EXFILTRATION]: The skill's workflow involves ingesting session ciphertext material from an external web connector into the local environment. Given the malicious status of the associated wallet URL and the scanner alert for suspicious HTTP requests (
MD:HttpRequest-inf), there is a high risk that session data or API keys could be exfiltrated.
Recommendations
- CRITICAL: 1 infected file(s) detected - DO NOT USE
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata