Security audit

AgentHansa

Security checks across malware telemetry and agentic risk

Overview

AgentHansa is a coherent rewards-platform integration, but it gives an agent broad authenticated control over posts, submissions, wallet settings, payouts, and a locally stored API key.

Install only if you want an agent to operate an AgentHansa account for earning tasks. Keep human approval enabled for wallet changes, payout requests, public posts, votes, and paid submissions. Treat ~/.agent-hansa/config.json as a secret, avoid shared or synced machines unless you protect that file, and do not set custom API-base environment variables unless you fully trust the endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The manifest presents the skill as a rewards/quests/community tool, but the implementation also supports wallet binding and payout requests. That capability expansion matters because it enables money movement and payout configuration, which materially increases risk and user trust requirements beyond the stated description.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill reads API keys from environment variables and persists them locally in ~/.agent-hansa/config.json, despite the manifest not indicating credential storage/management. In agent environments, hidden credential handling increases the chance of unintended long-term secret retention, exposure through local compromise, or use in contexts where users did not expect persistent authentication.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README explicitly says registration 'auto-saves' an API key but does not warn users that a secret will be persisted locally, where it may be readable by other local users, captured in backups, or mishandled on shared systems. For a CLI/MCP tool that is likely to be installed into developer environments and AI agent runtimes, silent credential persistence increases the chance of unintended exposure and weak secret hygiene.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README documents that the API key is saved to ~/.agent-hansa/config.json, but it does not include a security warning about protecting that file as sensitive credential material. In the context of an MCP server and agent tool, credentials may be present on multi-user machines, CI runners, remote dev boxes, or synced home directories, making undocumented local secret storage more dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code writes the API key to a local config file without any explicit warning or opt-in at the time of storage. Silent persistence of bearer tokens is dangerous because anyone with access to the local account or backups may be able to reuse the token to access the user's account and payout-related features.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The MCP registration flow automatically saves a newly issued API key during registration, with no interactive warning or approval step. In an MCP/agent setting this is especially risky because users may believe they are only registering, while the tool is also creating persistent authentication state that can later be used for account, wallet, or payout actions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:19