kaspa-wallet

clawhub:kaspa-wallet

View source
A
100/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

27

Score

100/100

LOW 27

Findings (27)

LOW
pip install arbitrary package
L19

Detects pip install of arbitrary packages that modify the host environment

pip install ka
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
System package manager install
L20

Detects system-level package installation via brew, apt, yum, or dnf

apt install p
FIX

Pin system packages to specific versions where the package manager supports it. Document the exact packages required and prefer containerized environments to avoid system-wide changes.

FP?

Likely FP if the match is standard setup documentation listing well-known system packages (e.g., apt install git curl) that are prerequisites.

LOW
Shell script file execution
L45

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L46

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L47

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L57

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L58

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L59

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L60

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L75

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L76

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L86

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L87

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L97

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L98

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L108

Detects execution of shell script files via bash/sh command or direct invocation

bash
./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L109

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L110

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L134

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L138

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L141

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L155

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L159

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L180

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L184

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L186

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.

LOW
Shell script file execution
L190

Detects execution of shell script files via bash/sh command or direct invocation

./kaswallet.sh
FIX

Replace direct shell script execution with a language-native implementation or a sandboxed executor. If shell scripts must run, restrict them to a vetted allowlist with integrity checks.

FP?

Likely FP if the match references running a script that is part of the skill's own repository (e.g., ./setup.sh) with clear, auditable contents.