Hedera Token Minting

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

The skill is a concise Hedera token-management guide, but it includes real token transfer and burn examples without safety guardrails.

Review before installing or using with real accounts. Treat the burn and transfer examples as high-impact operations: use testnet first, pin the SDK version, require explicit user confirmation, and ensure the correct Hedera keys and account IDs are being used before executing transactions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Hedera SDK Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

bash

npm install @hashgraph/sdk

Technical Analysis

The setup command installs @hashgraph/sdk without specifying an exact, reviewed version or using a committed lockfile. As a result, the effective dependency can change after the Skill has been audited. The package is consistent with the Skill's stated Hedera token-management purpose, and no evidence indicates that the package is currently malicious. However, relying on the mutable latest release creates a supply-chain risk if a future release is compromised or introduces unsafe behavior.

Depending on npm and package configuration, installation can also execute package lifecycle scripts with the permissions of the user performing the installation.

Attack Path

1. An attacker compromises the upstream package, its maintainer account, or its release process.
2. The attacker publishes a malicious version under the legitimate @hashgraph/sdk package name.
3. A user follows the documented unpinned installation command.
4. npm resolves and downloads the malicious latest version.
5. Malicious lifecycle code may execute during installation, or malicious library code may execute when imported and used by the token-management examples.

Impact Assessment

Successful exploitation could execute code with the privileges of the user running npm or the application. Depending on the environment, this could expose local files, environment variables, Hedera credentials, account keys, or transaction data. Malicious SDK behavior could also alter, redirect, or forge token-related operations initiated by the application. The practical scope is limited by the installing user's operating-system permissions and the credentials available to the application.

Remediation

View remediation

Remediation Suggestions

• Pin @hashgraph/sdk to an exact version that has been reviewed, rather than installing the mutable latest release.
• Generate and commit a package lockfile, then use npm ci in reproducible installation and deployment workflows.
• Review dependency integrity information and monitor the pinned package version for security advisories.
• Use an approved package registry and enforce dependency allowlists where possible.
• Consider installing with lifecycle scripts disabled, such as npm ci --ignore-scripts, when compatible with the package and build process.
• Upgrade dependencies through a controlled review process that evaluates release notes, package provenance, integrity hashes, and transitive dependency changes.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description scopes the skill to creating and managing tokens via minting, NFT creation, supply setup, and permission configuration. However, the documented code also includes transfer and burn transactions, which are distinct operational capabilities not disclosed in that description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The burn example performs irreversible on-chain destruction of tokens without any warning, confirmation guidance, or discussion of prerequisites such as possession of the proper supply key. In a skill intended for agent use, omission of destructive-operation warnings can lead to accidental asset loss if a user or agent copies the example into production workflows without understanding the finality of burn actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top-level documentation frames the skill as focused on token minting, but later sections document transferring tokens and burning supply. This is an intent-level mismatch in the file's own documentation because the heading suggests a narrower purpose than the code examples actually cover.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.