T06 · System Persistence
Error
- Location
SKILL.md:121- Finding
Persistent Background Services Are Started Without User Approval
- Content
View full analysis
- Remediation
View remediation
Security audit
Pacman Hedera DeFi AI Agent
Security checks for vulnerabilities and agentic risk
Overview
This wallet skill is not clearly malicious, but it gives an agent broad control over real funds and background services with inconsistent consent controls and unverified runtime code.
Install only if you intentionally want an autonomous Hedera wallet agent and you have separately reviewed the actual runtime repository. Keep wallet funds limited, verify daemon behavior before use, disable automatic startup where possible, avoid key backups to shared folders, and do not rely on the Markdown approval rules as the only protection for real transactions.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
other
Error
- Location
SKILL.md:105- Finding
Uncertainty Handling Directs the Agent to Execute Additional Live Financial Transactions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:17- Finding
Security-Critical Runtime and Dependency Installation Logic Is Missing from the Audited Package
- Content
View full analysis
**Runtime:** This skill drives `./launch.sh`, a zero-dependency bash launcher included in the pacman-hedera repository. It installs `uv` on first run, enforces `.env` existence, and dispatches to `uv run python -m cli.main`. All credentials stay local in `.env` — nothing is transmitted to external endpoints except Hedera mainnet RPC and SaucerSwap API. ``` Related packaging instructions appear in `README.md`, lines 3-14: ```bash ## Setup Create a symlink from the repo root: ln -s ../../../SKILL.md SKILL.md Or copy it: cp ../../../SKILL.md SKILL.md ``` ### Technical Analysis The audited artifact contains only `README.md` and `SKILL.md`. It does not contain the referenced `launch.sh`, Python CLI modules, dependency manifests, lockfiles, daemon implementation, governance enforcement code, or `scripts/harvest_knowledge.py`. Consequently, the audit cannot verify the claims that: - Wallet credentials remain local. - Only Hedera and SaucerSwap endpoints receive data. - Transfer whitelisting is enforced. - Swap and daily limits cannot be bypassed. - The HBAR reserve is protected. - The first-run installation of `uv` uses an authenticated and pinned source. - The invoked Python environment resolves only reviewed dependencies. The skill nevertheless instructs the agent to execute the absent launcher with access to wallet-related environment variables. Security therefore depends on code supplied outside the reviewed artifact. ### Attack Path 1. A user reviews or installs this documentation-only skill and relies on its local-only and safety-control claims. 2. The user obtains, links, or checks out a separate repository containing `launch.sh` and the Python runtime. 3. The agent invokes that unaudited launcher with access to wallet configuration and private-key enviro ...[truncated 999 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md requires: anyBins: [python3, python] env: [PRIVATE_KEY, HEDERA_ACCOUNT_ID, PACMAN_NETWORK] configPaths: ["./data/", "./.env"] os: [darwin, linux] ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text Any operation | +- DEFAULT: Main account (from .env HEDERA_ACCOUNT_ID) +- Robot commands ONLY: Robot account (nickname "Bitcoin Rebalancer Daemon") +- Robot has $0? -> "Needs funding before rebalancing." Never suggest starting it. +- Deprecated accounts? -> IGNORE. Never reference to users.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text Any operation | +- DEFAULT: Main account (from .env HEDERA_ACCOUNT_ID) +- Robot commands ONLY: Robot account (nickname "Bitcoin Rebalancer Daemon") +- Robot has $0? -> "Needs funding before rebalancing." Never suggest starting it. +- Deprecated accounts? -> IGNORE. Never reference to users.
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill repeatedly says write actions require explicit user approval, but later states the CLI auto-detects non-interactive mode and auto-confirms commands. In an agent setting, that contradiction can cause a simple natural-language request or misclassification to directly execute swaps, sends, daemon actions, or HCS writes without a real confirmation barrier.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 95% confidence
- Finding
The hcs10 send capability gives the agent a generic outbound communication channel to connected topics. In a wallet agent with access to portfolio data, logs, and operational context, such a channel can be abused to exfiltrate sensitive information or relay attacker-controlled content to external systems.
- Content
md | `hcs signals` | `hcs signals` | View recent investment signals | — | | `hcs10 setup` | `hcs10 setup` | Create public inbound topic | — | | `hcs10 connect` | `hcs10 connect <topic_id>` | Connect to another agent | — | | `hcs10 send` | `hcs10 send <id> <msg>` | Send message to connected agent | — | | `hcs feedback submit` | `hcs feedback submit <type> "msg"` | Submit feedback (bug/suggestion/success/warning) | — | | `hcs feedback read` | `hcs feedback read` | Read recent feedback | — |
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | Operation Type | Examples | Behaviour | |---|---|---| | **READ** | balance, price, portfolio, history, status | Act immediately — no confirmation needed | | **WRITE** | swap, send, HCS publish, daemon start/stop, limit orders | Show proposed action, wait for explicit user approval before executing | **"Proactive" means proactively *informing* — never proactively *executing*.** Never chain write operations without re-confirming each one. When in doubt, show and ask.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md NEVER create new sub-accounts, rename accounts, or switch active accounts unless explicitly commanded. If a transaction fails due to an account issue, report it; do not try to "fix" the account structure. ### 4. Halt on Routing/Pool Errors If the router says `No route found` or a pool is missing, do NOT attempt to bypass it by checking V1 pools, blindly approving random pools, or executing complex multi-hop trades without consent. Suggest the fix (e.g., "Should I search for a pool?") and wait. **V1 is NEVER a fallback for V2.** ### 5. Strict Balance Verification Before proposing or executing ANY swap or transfer, run `balance` to verify sufficient funds. Never assume balances from previous context or memory.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The startup trigger fires on broad greetings like 'hi' or 'hello', causing immediate execution of multiple commands. In an agent environment, overly broad activation increases the chance of unintended wallet inspection, history retrieval, daemon interaction, and external calls from casual conversation or accidental invocation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs the agent to automatically start background daemons if they are not running, even during a greeting flow. Starting persistent services is a state-changing action with ongoing effects, and doing so without a clear warning or approval breaks the claimed confirmation model and can surprise users.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
L0090-L0092 forbids creating new sub-accounts unless explicitly commanded, while L0212-L0213 presents 'full setup' as initializing accounts, keys, daemons, and the robot rebalancer. Because the setup path is described as a proactive onboarding option rather than a narrowly scoped explicit account-creation request, the documentation creates conflicting guidance about when account creation is permitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs backup export of private keys to a default filesystem location without a prominent high-risk warning. Creating plaintext key backups materially increases credential exposure risk through local malware, shared machines, cloud-synced folders, or accidental disclosure.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 98% confidence
- Finding
Auto-confirm in non-interactive mode effectively turns agent-issued commands into immediate execution, undermining the skill's repeated requirement for explicit user approval on state-changing actions. In a wallet/trading agent, that can directly lead to unauthorized swaps, transfers, or service changes from ambiguous prompts or prompt-injection-induced actions.
- Content
md Entry point: `./launch.sh <command>` **No special flags needed.** The app auto-detects non-interactive mode and auto-confirms. Agents and humans use identical commands. ## Master Command Table
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill exposes general cross-agent messaging primitives, including connecting to arbitrary topics and sending messages, which goes beyond the stated DeFi/HCS signal role. These commands create an exfiltration and command-and-control surface because an agent handling wallet data could transmit sensitive operational context to external parties or untrusted topics.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md 💳 *ACCOUNT* — multi-account management 📈 *STAKING* — stake/unstake HBAR 💧 *LIQUIDITY* — LP positions without a DEX UI 📋 *LIMIT ORDERS* — auto-execute on price triggers 🤖 *ROBOT* — autonomous BTC rebalancer 📡 *MESSAGING* — on-chain HCS signals ⚙️ *SYSTEM* — diagnostics, daemons, data refresh
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill describes interaction logging and fine-tuning use without a clear end-user warning or consent flow. Because the logs include commands, outputs, errors, stack traces, and account IDs, silent collection materially affects user privacy expectations in a financial-agent context.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The logging section calls for broad retention of detailed operational records, including exact errors, stack traces, account IDs, and execution metadata, and then repurposes them for training. For a DeFi wallet agent, this is sensitive telemetry that can reveal holdings, behavior, counterparties, and operational weaknesses over time.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The skill says to immediately send NFT images to Telegram when asked to see them, without warning that this may fetch and retransmit external media. While lower risk than wallet operations, it still expands the attack surface for privacy leakage, malicious media URLs, or unexpected external content handling.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The training-data harvesting workflow is unrelated to normal end-user wallet operations and encourages collection of incidents and execution records for model tuning. In a wallet agent context, this increases the risk that sensitive financial, behavioral, or error data is repurposed and retained beyond what users expect.
- Content