Security audit

Hedera Transaction Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Hedera transaction helper, but it normalizes signing and submitting real-value transactions without enough review or confirmation guidance.

Review carefully before installing or using. Treat any mainnet signing or submission as capable of moving real funds; prefer testnet by default, pin the SDK version, and require explicit human confirmation after checking account IDs, token IDs, amounts, fees, memos, and network selection.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:8
Finding: Unpinned Third-Party SDK Dependency
Content: View full analysis
Remediation: View remediation
``` 2. Commit a reviewed `package-lock.json` containing dependency versions and integrity hashes. 3. Use `npm ci` in automated or reproducible environments so installation fails when the manifest and lockfile disagree. 4. Review direct and transitive dependency changes before upgrades, and use automated vulnerability and provenance checks. 5. Where operationally compatible, disable package lifecycle scripts during installation: ```bash npm ci --ignore-scripts ``` 6. Run dependency installation and transaction tooling with least privilege, isolated from unrelated credentials and sensitive files. 7. Document a controlled update process that verifies package ownership, release provenance, checksums or npm integrity metadata, and security advisories before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly positions itself to build, sign, and submit Hedera transactions, including on mainnet, but does not warn that these actions can move real funds and are generally irreversible once broadcast. In an agent skill context, omission of such safety guidance increases the chance of accidental real-world financial loss from misuse, wrong-network execution, or unreviewed transaction submission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The transfer example shows signing and executing an HBAR transfer immediately, without any cautions to validate the recipient, amount, source account, or selected network. In a reusable skill, this can normalize unsafe copy-paste behavior and lead to accidental transfers of real funds that cannot be easily reversed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.