Hedera Transaction Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Hedera transaction helper, but it normalizes signing and submitting real-value transactions without enough review or confirmation guidance.

Review carefully before installing or using. Treat any mainnet signing or submission as capable of moving real funds; prefer testnet by default, pin the SDK version, and require explicit human confirmation after checking account IDs, token IDs, amounts, fees, memos, and network selection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Third-Party SDK Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 8–12 **Vulnerability Type**: Unpinned npm dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Setup ```bash npm install @hashgraph/sdk ``` ``` ### Technical Analysis The installation command does not specify an exact version of `@hashgraph/sdk` or enforce lockfile integrity. Consequently, npm resolves whichever package version is current at installation time. The reviewed skill can therefore behave differently in the future without any change to `SKILL.md`. No evidence indicates that the named package is currently malicious. The vulnerability is the unsafe dependency-resolution practice: if the package, a transitive dependency, or its release channel is compromised, malicious lifecycle scripts could execute during installation. Compromised runtime code could also alter transaction construction, signing, or submission behavior. ### Attack Path 1. An attacker compromises the npm package, one of its transitive dependencies, a maintainer account, or the associated publishing pipeline. 2. The attacker publishes a malicious version that remains compatible with the unconstrained package name. 3. A user or agent follows the skill instructions and runs `npm install @hashgraph/sdk`. 4. npm resolves and installs the attacker-controlled release because no exact version or reviewed lockfile is required. 5. Malicious lifecycle code executes with the permissions of the npm process, or malicious SDK code activates when the transaction builder is used. 6. The malicious code may access files and environment variables available to the user, interfere with transaction handling, or transmit accessible sensitive material. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the account that runs npm or invokes the compromised SDK. The attacker could access files, environment variables, wallet-related material, or credentials available ...[truncated 422 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK to an exact, reviewed version rather than allowing npm to resolve the latest release: ```bash npm install --save-exact @hashgraph/sdk@<reviewed-version> ``` 2. Commit a reviewed `package-lock.json` containing dependency versions and integrity hashes. 3. Use `npm ci` in automated or reproducible environments so installation fails when the manifest and lockfile disagree. 4. Review direct and transitive dependency changes before upgrades, and use automated vulnerability and provenance checks. 5. Where operationally compatible, disable package lifecycle scripts during installation: ```bash npm ci --ignore-scripts ``` 6. Run dependency installation and transaction tooling with least privilege, isolated from unrelated credentials and sensitive files. 7. Document a controlled update process that verifies package ownership, release provenance, checksums or npm integrity metadata, and security advisories before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly positions itself to build, sign, and submit Hedera transactions, including on mainnet, but does not warn that these actions can move real funds and are generally irreversible once broadcast. In an agent skill context, omission of such safety guidance increases the chance of accidental real-world financial loss from misuse, wrong-network execution, or unreviewed transaction submission.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The transfer example shows signing and executing an HBAR transfer immediately, without any cautions to validate the recipient, amount, source account, or selected network. In a reusable skill, this can normalize unsafe copy-paste behavior and lead to accidental transfers of real funds that cannot be easily reversed.

Static analysis

No suspicious patterns detected.