HederaToolbox

• Analyzed: May 11, 2026, 7:00 AM
• Findings: 1
• Version: 1.0.3
• Hash: ceee9b974d9b947f26f69ddd2db35768ac25dbb2323c298b64008e665ab314a5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a pay-per-call blockchain data service that uses a user's public Hedera Account ID as the sole authentication token ('api_key'). Because Hedera account IDs are public identifiers visible on any block explorer, this architectural flaw allows unauthorized third parties to potentially exhaust a user's pre-funded HBAR balance simply by knowing their account ID. While the skill does not exhibit intentional malicious behavior such as stealing private keys or local files, this weak authentication mechanism (SKILL.md) constitutes a significant security vulnerability.