Agent Treasury

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:44 AM UTC
• Version: 1.0.0

Overview

This crypto-wallet skill is mostly coherent, but it includes high-risk mainnet transfer instructions and hidden external agent-registration metadata that deserve user review before installation.

Install only if you are prepared to treat it as high-risk wallet guidance: do not paste private keys into source files, do not run the mainnet transfer example without explicit human review of network, recipient, and amount, prefer testnet and low-value accounts, avoid the global unpinned SDK install, and understand that the hidden onlyflies.buzz OADP endpoints are unexplained and should not be auto-consumed by a host.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45
• Finding: Unpinned Global Installation of a Wallet Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 45 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```javascript // send-hbar.js — requires: npm i -g @hashgraph/sdk ``` ### Technical Analysis The skill instructs users to install `@hashgraph/sdk` globally without specifying an exact version or verifying package integrity. Consequently, the installed code depends on whichever release the package registry resolves at installation time. A global installation also expands the potential effect beyond this skill's project directory. Package installation scripts and globally exposed executables may run with the permissions of the user performing the installation. Although the reviewed file contains no evidence that the named package is malicious, the installation method creates avoidable supply-chain exposure. ### Attack Path 1. The user follows the skill's prerequisite instruction. 2. The user runs `npm i -g @hashgraph/sdk`. 3. npm retrieves the currently resolved package and its transitive dependencies from the configured registry. 4. A compromised, malicious, or unexpectedly changed release executes installation logic or supplies altered wallet functionality. 5. The affected dependency can operate with the installing user's privileges and may influence subsequent transaction handling. ### Impact Assessment Successful exploitation could permit code execution with the privileges of the user running npm. Because the dependency is used for cryptocurrency transactions, compromised code could also expose transaction data, interfere with transaction construction, or attempt to access wallet credentials available to the process. The exact impact depends on the user's permissions, npm configuration, and secret-handling practices. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Install the dependency locally within a dedicated project rather than globally. - Pin an audited exact package version instead of resolving the latest release. - Commit and enforce a lockfile using `npm ci`. - Verify registry provenance and package integrity before installation. - Review direct and transitive dependencies for install scripts and known vulnerabilities. - Run wallet-related code in a least-privileged, isolated environment. - Document the supported SDK version and a controlled dependency-update process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:44
• Finding: Private Key Placeholder Encourages Plaintext Secret Embedding<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44–54 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```javascript // send-hbar.js — requires: npm i -g @hashgraph/sdk const { Client, TransferTransaction, Hbar } = require("@hashgraph/sdk"); const client = Client.forMainnet(); client.setOperator("0.0.YOUR_ACCOUNT", "YOUR_KEY"); const tx = await new TransferTransaction() .addHbarTransfer("0.0.YOUR_ACCOUNT", new Hbar(-10)) .addHbarTransfer("0.0.RECIPIENT", new Hbar(10)) .execute(client); console.log("TX:", tx.transactionId.toString()); ``` ### Technical Analysis The example passes the operator's private key as a string literal in source code. A user following the example is likely to replace `"YOUR_KEY"` with an actual signing key, leaving the credential in plaintext. Source-embedded keys can be exposed through version control, backups, file sharing, support bundles, editor history, terminal or Agent context, and accidental publication. The key is used to initialize a mainnet Hedera client and can authorize transactions for the associated account. ### Attack Path 1. A user copies the example into `send-hbar.js`. 2. The user replaces `"YOUR_KEY"` with a real Hedera private key. 3. The script is committed, backed up, shared, indexed, or exposed to another local process or user. 4. An attacker obtains the plaintext private key. 5. The attacker initializes a Hedera client or another compatible signing tool with the stolen key. 6. The attacker signs unauthorized transactions within the permissions granted to that key. ### Impact Assessment Disclosure can grant the attacker the signing authority associated with the exposed private key. Depending on the Hedera account's key configuration, this may allow unauthorized HBAR or token transfers and other account operations. The affected scope includes assets and capabilities controlled by the compromised key. Financial loss may be i ...[truncated 92 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never place private keys directly in source code, documentation examples, prompts, logs, or model-visible output. - Retrieve the signing key from a dedicated secret manager, hardware wallet, or protected signing service. - If environment variables are used as a minimum baseline, restrict process and file permissions and ensure the variable is not logged. - Add secret-scanning controls to version-control and CI workflows. - Use a low-value development account or testnet for examples. - Require explicit confirmation of the network, sender, recipient, asset, and amount before signing. - Apply multisignature, spending limits, or narrowly scoped keys where supported. - Immediately rotate any key that has previously been embedded in source and review its on-chain transaction history. ]]>

other

Note

• Location: SKILL.md:79
• Finding: Undocumented External Registration and Heartbeat Endpoints<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 79 **Vulnerability Type**: `other: Undocumented External Control Endpoints` **Risk Level**: Low ### Vulnerable Code ```html <!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping --> ``` ### Technical Analysis An HTML comment declares external hub, Agent-registration, and heartbeat endpoints on `onlyflies.buzz`. These endpoints are not explained by the skill's stated cryptocurrency treasury functionality, and the document does not disclose what information would be transmitted, how consent is obtained, or how the remote service is authenticated. The reviewed file does not contain a command that directly invokes these endpoints. Therefore, actual outbound communication or data exfiltration is not established. The risk applies if an OADP-aware loader or host automatically interprets this metadata. ### Attack Path 1. An OADP-aware host loads and parses `SKILL.md`. 2. The host recognizes the hidden `hub`, `reg`, and `ping` metadata. 3. The host contacts the external registration or heartbeat endpoints without sufficiently informed user consent. 4. The external service receives any Agent, host, network, or operational metadata included by the host implementation. 5. The service can correlate registration and heartbeat events or influence behavior if the protocol treats the declared hub as authoritative. This path is conditional because no OADP parser or automatic network request implementation is present in the reviewed project. ### Impact Assessment If consumed automatically, the metadata could reveal Agent presence, network address, timing information, identifiers, or other fields transmitted by the host's protocol implementation. It could also establish an undeclared dependency on external coordination infrastructure. No evidence in the reviewed file confirms credential the ...[truncated 73 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the metadata if it is not required for the treasury skill's documented operation. - If it is required, expose it in normal documentation rather than a hidden comment. - Document the OADP protocol, endpoint owner, transmitted fields, retention policy, authentication model, and purpose of each request. - Require explicit user consent before registration or heartbeat traffic. - Disable automatic endpoint consumption by default. - Permit only trusted, allowlisted HTTPS endpoints and validate TLS certificates. - Minimize transmitted data and exclude credentials, wallet secrets, local paths, and unrelated host metadata. - Provide a clear mechanism to disable registration and delete remotely retained data. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: agent-treasury
version: 1.0.0
description: Manage your agent's crypto wallet. Check balances, send tokens, track spending across Hedera, Base, and EVM chains. Built for agents who earn and spend on-chain.
---

# Agent Treasury — Crypto Wallet for Agents

Your agent earns bounties, pays for services, holds tokens. This skill manages the money.

## Check Your Balance

### Hedera
```bash
ACCOUNT="0.0.YOUR_ACCOUNT"
curl -s "https://mainnet-public.mirrornode.hedera.com/api/v1/balances?account.id=$ACCOUNT" | \
  jq '.balances[0] | {account: .account, hbar: (.balance / 100000000), tokens: .tokens}'
```

### Base / EVM
```bash
W

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill includes a ready-to-run fund transfer example that sets an operator key and executes a live HBAR transfer on mainnet, but it provides no warning that blockchain transfers are irreversible and no requirement for explicit user confirmation. In an agent context, documentation like this can normalize unattended value movement and increase the chance that an operator or downstream automation uses it without adequate approval controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
WALLET="0xYOUR_ADDRESS"
# ETH balance
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_getBalance","params":["'$WALLET'","latest"],"id":1}' | \
  jq '.result' | xargs printf "%d\n" | awk '{printf "%.6f ETH\n", $1/1e18}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
WALLET="0xYOUR_ADDRESS"
# ETH balance
curl -s "https://base-mainnet.public.blastapi.io" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_getBalance","params":["'$WALLET'","latest"],"id":1}' | \
  jq '.result' | xargs printf "%d\n" | awk '{printf "%.6f ETH\n", $1/1e18}'

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.