FluxA-agent-wallet

• Analyzed: May 12, 2026, 3:23 AM
• Findings: 1
• Version: 1.4.5
• Hash: df90a0b9e243a2082e6a897bf3559cba486ad429943534e82ffefe54fcf15724
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a comprehensive financial wallet for AI agents with high-privilege capabilities, including the management of USDC funds and identity credentials. It is classified as suspicious due to the 'SCHEDULED-CHECKIN.md' file, which instructs the agent to establish persistence via daily scheduled tasks that execute remote code using 'npx -y @fluxa-pay/fluxa-wallet@latest'. This pattern introduces significant supply-chain risk by bypassing version pinning and automatically fetching/executing remote payloads from 'fluxapay.xyz'. Additionally, the instructions use forceful prompt-steering ('MUST') and command the agent to suppress 'process narration' and 'tool chatter,' which reduces transparency and could be used to mask unauthorized financial transactions or state changes.