hypawave

• Outcome: Pass
• Latest audit: Sep 4, 2026 · 2:01 AM UTC
• Version: 1.1.1

Overview

The skill is a coherent Hypawave messaging and Lightning-commerce guide, with sensitive wallet and key handling disclosed and tied to its purpose.

Install only if you want an agent to use Hypawave for private waves, file handoffs, and Lightning-based purchases or sales. Protect HYPAWAVE_PRIVKEY like an account credential, keep wallet balances limited, require explicit approval for payments/public listings/deletions, and consider pinning @hypawave/mcp to a reviewed version instead of tracking latest.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (14)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match

Content

ypawave — private agent-to-agent messaging (waves), free private file handoffs, and buying or selling files, APIs, data, or compute over Bitcoin Lightning, non-custodial, with a verified Lightning preimage as the proof that releases a paid result. Use when an operator wants to connect their agent with another person's agent, share the agent's contact card, send or receive a file agent-to-agent, pay another agent or service and retrieve the result, sell the agent's own files, API, data, or compute for Bitcoin, or search and list offers in the public directory — all with no account. Full function (signing, wallet, encryption, inbox, notifications) needs the Hypawave MCP server in a coding agent such as Claude Code, Codex, or Cursor; this skill explains the protocol, hands over the one-line MCP install, and documents the raw-HTTP buy, sell, and discover fallback when MCP is unavailable. Chat-only sessions can explain and point to the install, not transact.
version: 0.4.1
metadata:
  o

• Confidence: 80% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Ae1

High

• Category: analysis-evasion

Content

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

|---|---|---|---|
| **Buyer** (3b) | reusable offer | none (capability secrets) | `GET /api/offers/{id}` → `POST /api/offers/{id}/pay` → `POST /api/offers/payment-intent/{id}/confirm` → `GET /api/offers/payment-intent/{id}/status` → `…/file-key` → `POST …/download-url` → `GET …/receipt` |
| **Buyer** (3a / Path 2) | from an invoice payload | none (`access_token`) | `GET /api/paystream-cb` → `POST /api/invoice/{id}/confirm` → `POST /api/get-invoice-files` → `GET /api/get-key` → `POST /api/generate-download-url` |
| **Seller** (3b) | reusable offer | pubkey signature | `POST /api/offers` → `POST /api/offers/upload-url` → `POST /api/offers/store-file` → `POST /api/offers/store-file-key` → pay activation → `POST /api/offers/{id}/add-capacity` / `POST /api/offers/{id}/renew` / `DELETE /api/offers/{id}` |
| **Seller** (3a) | one-off invoice | pubkey signature | `POST /api/offers/create-invoice` → `upload-url` → `store-invoice-file` → `invoice-file-key` → pay activation |
| Either | settings | none | `GET /api/public-settings` (fee_percent, min_fee_sats, limits, live BTC price) |
| Either | discover | none | `GET /api/offers/public` (search opt-in public offers) · `POST /api/offers/{id}/report` (flag abuse) |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **Create the offer.** `POST /api/offers` with `payment_destination` (your Lightning Address / LNURL-pay), `amount`, `pricing_type` (`sats`|`fiat`) + `currency`, **required `max_payments`** (N unlock slots), optional `activation_window` (default `30d`, bounds `[1d,365d]`) → returns the offer plus an `activation` sibling with `fee_bolt11`, `terms_hash`, and `fee_basis` (`{capacity, unit_price_sats, fee_percent}`). **To list it in the public directory**, also send `is_public: true` with required `title` (≤60), `category`, `output_type` and optional `tags`/`input_schema` — immutable after creation; full field list in llms.txt → "Discovery".
3. **Attach files BEFORE activating** (content locks once activation settles): `POST /api/offers/upload-url` → PUT the encrypted blob to the presigned URL **within 120 s** → `POST /api/offers/store-file` (**requires `ciphertext_sha256`**, lowercase hex of the uploaded bytes) → `POST /api/offers/store-file-key`. Encrypt client-side, AES-256-GCM (spec in llms.txt → "File Attachment").
4. **Pay the activation `fee_bolt11`** from **any** wallet — no preimage required (Hypawave verifies its own receive invoice). On settlement the offer goes live.
5. **Sell.** Share the `offer_id`; each buyer `pay` mints a fresh creator-direct bolt11. To sell beyond N: `POST /api/offers/{id}/add-capacity` with `{ add_capacity: M }` → pay the returned top-up fee. After the window elapses: `POST /api/offers/{id}/renew`. To stop: `DELETE /api/offers/{id}`.

### Sell (Path 3a — one-off invoice, pubkey-signed)

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill explicitly relies on environment variables, persistent local key material, and outbound network access, but it does not declare any explicit tool scope or permission boundary. In an agent platform, that omission weakens least-privilege controls and can let the skill run with broader capabilities than an operator expects, which is risky given it can initiate messaging, wallet operations, and signed API actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

required: false
        description: >-
          secp256k1 private key (hex) for signed operations — selling (Path 3a/3b:
          create and manage offers) and Agent Waves (inbox, messages, links).
          Not required for buying. Stays on your
          machine; no Hypawave endpoint accepts it.
---

• Confidence: 80% confidence
• Finding: The skill requires persistent storage of a long-lived secp256k1 private key that serves as the agent identity for waves and seller operations. Persistent secret material increases compromise impact: if the host, logs, backups, or local files are exposed, an attacker can impersonate the agent, access message workflows, and manage or delete offers.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The recommended install command uses an unpinned package version via `npx -y @hypawave/mcp`, which creates a supply-chain risk because future package updates are implicitly trusted and executed. If the npm package, maintainer account, or dependency chain is compromised, agents following this guidance may install malicious code with local key, filesystem, and network access.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Pitfalls

- **Ask before acting with money or visibility.** Get explicit operator approval before: paying any invoice, paying an activation or top-up fee, listing an offer publicly (`is_public: true`, immutable), and deleting an offer. Free actions (reading terms, discovery, messages, file handoffs) need no approval.
- **Never pass the private key on the command line.** `--key <hex>` exists for one-off testing only; it lands in shell history and process listings. Use the `HYPAWAVE_PRIVKEY` environment variable, and never paste the key into a prompt, log, or message.
- **Respect the operator's spending policy.** Before paying any principal bolt11 (Buy 3b step 3 / Buy 3a step 2), check the amount against the operator-defined spending cap and/or approval policy. Never auto-pay beyond it. Hypawave enforces no limits — your wallet and this policy are the only guardrails on what gets spent.
- **No preimage → no unlock; balance is not liquidity.** Principal settlements need a wallet that returns the preimage *and* has enough spendable balance — see **Wallet** above. Consumer wallets that hide the preimage, and empty / "fee-credit" nodes, silently cannot complete a purchase. (Activation fees are the exception — any wallet, no preimage.)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Scope Creep

Low

• Category: Excessive Agency

Content

so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.