Hedera Token Minting

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

The skill is a concise Hedera token-management guide, but it includes real token transfer and burn examples without safety guardrails.

Review before installing or using with real accounts. Treat the burn and transfer examples as high-impact operations: use testnet first, pin the SDK version, require explicit user confirmation, and ensure the correct Hedera keys and account IDs are being used before executing transactions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Hedera SDK Dependency## Vulnerability Details **File Location**: `SKILL.md`, line 12 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ```bash npm install @hashgraph/sdk ``` ### Technical Analysis The setup command installs `@hashgraph/sdk` without specifying an exact, reviewed version or using a committed lockfile. As a result, the effective dependency can change after the Skill has been audited. The package is consistent with the Skill's stated Hedera token-management purpose, and no evidence indicates that the package is currently malicious. However, relying on the mutable latest release creates a supply-chain risk if a future release is compromised or introduces unsafe behavior. Depending on npm and package configuration, installation can also execute package lifecycle scripts with the permissions of the user performing the installation. ### Attack Path 1. An attacker compromises the upstream package, its maintainer account, or its release process. 2. The attacker publishes a malicious version under the legitimate `@hashgraph/sdk` package name. 3. A user follows the documented unpinned installation command. 4. npm resolves and downloads the malicious latest version. 5. Malicious lifecycle code may execute during installation, or malicious library code may execute when imported and used by the token-management examples. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running npm or the application. Depending on the environment, this could expose local files, environment variables, Hedera credentials, account keys, or transaction data. Malicious SDK behavior could also alter, redirect, or forge token-related operations initiated by the application. The practical scope is limited by the installing user's operating-system permissions and the credentials available to the application.
• Remediation: ## Remediation Suggestions - Pin `@hashgraph/sdk` to an exact version that has been reviewed, rather than installing the mutable latest release. - Generate and commit a package lockfile, then use `npm ci` in reproducible installation and deployment workflows. - Review dependency integrity information and monitor the pinned package version for security advisories. - Use an approved package registry and enforce dependency allowlists where possible. - Consider installing with lifecycle scripts disabled, such as `npm ci --ignore-scripts`, when compatible with the package and build process. - Upgrade dependencies through a controlled review process that evaluates release notes, package provenance, integrity hashes, and transitive dependency changes.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest description scopes the skill to creating and managing tokens via minting, NFT creation, supply setup, and permission configuration. However, the documented code also includes transfer and burn transactions, which are distinct operational capabilities not disclosed in that description.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The burn example performs irreversible on-chain destruction of tokens without any warning, confirmation guidance, or discussion of prerequisites such as possession of the proper supply key. In a skill intended for agent use, omission of destructive-operation warnings can lead to accidental asset loss if a user or agent copies the example into production workflows without understanding the finality of burn actions.

Intent-Code Divergence

Low

• Confidence: 82% confidence
• Finding: The top-level documentation frames the skill as focused on token minting, but later sections document transferring tokens and burning supply. This is an intent-level mismatch in the file's own documentation because the heading suggests a narrower purpose than the code examples actually cover.

Static analysis

No suspicious patterns detected.