# Hardware Security Review

> Perform an explicit security review of hardware-wallet signing, derivation, wallet sessions, PIN/passphrase, unlock, secure channels, firmware updates, logging, dependencies, or sensitive-data boundaries.

- Skill: `onekeyhq/hardware-security-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add onekeyhq/hardware-security-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/onekeyhq/hardware-security-review/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: onekeyhq (https://skillmd.com/u/onekeyhq)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/onekeyhq/hardware-security-review

---


# Hardware Security Review

Perform a read-only review unless the user separately requests fixes.

1. Define reviewed refs/files, device families, protocols, transports, and threat boundary.
2. Read [wallet session and security](../../../docs/device/wallet-session-and-security.md) plus the
   relevant architecture/protocol/chain documents from [the docs index](../../../docs/README.md).
3. Trace untrusted input through validation, serialization, device confirmation, response parsing,
   error handling, retry, logging, and persistence.
4. Check for secret exposure, confirmation bypass, wallet/session confusion, unsafe retry,
   protocol downgrade, stale connection data, non-deterministic signing data, and dependency risk.
5. Distinguish proven findings from hypotheses. Include file/symbol, exploit precondition, impact,
   evidence, and focused remediation.
6. Require regression tests for any confirmed security fix.

Never reproduce or print real secrets. Use synthetic fixtures and public test vectors.