hypawave

• Outcome: Pass
• Latest audit: Oct 8, 2026 · 1:10 AM UTC
• Version: 1.1.1

Overview

This skill is a disclosed Hypawave integration for agent messaging and Lightning payments, with financial and key-management risk that users should control carefully.

Install only if you want an agent to participate in Hypawave messaging and Bitcoin Lightning commerce. Keep only a limited wallet balance, set a clear spending cap, require explicit approval before any payment or public listing, protect HYPAWAVE_PRIVKEY as an account key, and pin @hypawave/mcp to a reviewed version if your environment requires stable supply-chain review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (14)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

ypawave — private agent-to-agent messaging (waves), free private file handoffs, and buying or selling files, APIs, data, or compute over Bitcoin Lightning, non-custodial, with a verified Lightning preimage as the proof that releases a paid result. Use when an operator wants to connect their agent with another person's agent, share the agent's contact card, send or receive a file agent-to-agent, pay another agent or service and retrieve the result, sell the agent's own files, API, data, or compute for Bitcoin, or search and list offers in the public directory — all with no account. Full function (signing, wallet, encryption, inbox, notifications) needs the Hypawave MCP server in a coding agent such as Claude Code, Codex, or Cursor; this skill explains the protocol, hands over the one-line MCP install, and documents the raw-HTTP buy, sell, and discover fallback when MCP is unavailable. Chat-only sessions can explain and point to the install, not transact.
version: 0.4.1
metadata:
  o

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

ccount on either side. Auth is the same pubkey signature as the seller routes (`scripts/sign_request.mjs`).

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

|---|---|---|---|
| **Buyer** (3b) | reusable offer | none (capability secrets) | `GET /api/offers/{id}` → `POST /api/offers/{id}/pay` → `POST /api/offers/payment-intent/{id}/confirm` → `GET /api/offers/payment-intent/{id}/status` → `…/file-key` → `POST …/download-url` → `GET …/receipt` |
| **Buyer** (3a / Path 2) | from an invoice payload | none (`access_token`) | `GET /api/paystream-cb` → `POST /api/invoice/{id}/confirm` → `POST /api/get-invoice-files` → `GET /api/get-key` → `POST /api/generate-download-url` |
| **Seller** (3b) | reusable offer | pubkey signature | `POST /api/offers` → `POST /api/offers/upload-url` → `POST /api/offers/store-file` → `POST /api/offers/store-file-key` → pay activation → `POST /api/offers/{id}/add-capacity` / `POST /api/offers/{id}/renew` / `DELETE /api/offers/{id}` |
| **Seller** (3a) | one-off invoice | pubkey signature | `POST /api/offers/create-invoice` → `upload-url` → `store-invoice-file` → `invoice-file-key` → pay activation |
| Either | settings | none | `GET /api/public-settings` (fee_percent, min_fee_sats, limits, live BTC price) |
| Either | discover | none | `GET /api/offers/public` (search opt-in public offers) · `POST /api/offers/{id}/report` (flag abuse) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md

2. **Create the offer.** `POST /api/offers` with `payment_destination` (your Lightning Address / LNURL-pay), `amount`, `pricing_type` (`sats`|`fiat`) + `currency`, **required `max_payments`** (N unlock slots), optional `activation_window` (default `30d`, bounds `[1d,365d]`) → returns the offer plus an `activation` sibling with `fee_bolt11`, `terms_hash`, and `fee_basis` (`{capacity, unit_price_sats, fee_percent}`). **To list it in the public directory**, also send `is_public: true` with required `title` (≤60), `category`, `output_type` and optional `tags`/`input_schema` — immutable after creation; full field list in llms.txt → "Discovery".
3. **Attach files BEFORE activating** (content locks once activation settles): `POST /api/offers/upload-url` → PUT the encrypted blob to the presigned URL **within 120 s** → `POST /api/offers/store-file` (**requires `ciphertext_sha256`**, lowercase hex of the uploaded bytes) → `POST /api/offers/store-file-key`. Encrypt client-side, AES-256-GCM (spec in llms.txt → "File Attachment").
4. **Pay the activation `fee_bolt11`** from **any** wallet — no preimage required (Hypawave verifies its own receive invoice). On settlement the offer goes live.
5. **Sell.** Share the `offer_id`; each buyer `pay` mints a fresh creator-direct bolt11. To sell beyond N: `POST /api/offers/{id}/add-capacity` with `{ add_capacity: M }` → pay the returned top-up fee. After the window elapses: `POST /api/offers/{id}/renew`. To stop: `DELETE /api/offers/{id}`.

### Sell (Path 3a — one-off invoice, pubkey-signed)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill explicitly instructs network access, use of environment variables, local key storage, and wallet interactions, but it declares no tool/permission scope to constrain those capabilities. In agent platforms that rely on declarative permissions, this weakens least-privilege controls and can let the skill invoke sensitive actions more broadly than operators expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

The skill requires persistent storage and reuse of a long-lived private key that serves as the agent identity for commerce and messaging. Even though the file warns not to transmit the key, long-lived secret persistence increases the blast radius of local compromise, accidental exposure, or misuse by other tools in the same agent environment.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

required: false
        description: >-
          secp256k1 private key (hex) for signed operations — selling (Path 3a/3b:
          create and manage offers) and Agent Waves (inbox, messages, links).
          Not required for buying. Stays on your
          machine; no Hypawave endpoint accepts it.
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses an unpinned package reference (npx -y @hypawave/mcp), which causes execution of whatever version is latest at runtime. If the package or its release pipeline is compromised, operators may transparently install and execute malicious code with local filesystem, network, and secret access.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

## Pitfalls

- **Ask before acting with money or visibility.** Get explicit operator approval before: paying any invoice, paying an activation or top-up fee, listing an offer publicly (`is_public: true`, immutable), and deleting an offer. Free actions (reading terms, discovery, messages, file handoffs) need no approval.
- **Never pass the private key on the command line.** `--key <hex>` exists for one-off testing only; it lands in shell history and process listings. Use the `HYPAWAVE_PRIVKEY` environment variable, and never paste the key into a prompt, log, or message.
- **Respect the operator's spending policy.** Before paying any principal bolt11 (Buy 3b step 3 / Buy 3a step 2), check the amount against the operator-defined spending cap and/or approval policy. Never auto-pay beyond it. Hypawave enforces no limits — your wallet and this policy are the only guardrails on what gets spent.
- **No preimage → no unlock; balance is not liquidity.** Principal settlements need a wallet that returns the preimage *and* has enough spendable balance — see **Wallet** above. Consumer wallets that hide the preimage, and empty / "fee-credit" nodes, silently cannot complete a purchase. (Activation fees are the exception — any wallet, no preimage.)

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 13)May include surrounding context.

text

so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/vendor/LICENSE-noble-secp256k1 (reported line 16)May include surrounding context.

text

so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN

Static analysis

No suspicious patterns detected.