BountyHub Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:14 PM UTC
• Version: 0.1.7

Overview

This skill appears purpose-aligned, but it asks users to install an unpinned global CLI and use it for wallet-authenticated escrow actions that can affect funds.

Review this skill carefully before installing. Use a pinned and verified package version if available, confirm the ACP endpoint and manifest origin, keep session tokens out of logs and shell history, and independently verify every wallet-signing prompt including network, recipient, asset, amount, mission ID, and calldata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:72

Finding

Unpinned Global Installation of an Executable Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 72–76
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Install

```bash
npm install -g @h1dr4/bountyhub-agent

text

### Technical Analysis

The skill instructs users to globally install `@h1dr4/bountyhub-agent` without specifying an exact package version, integrity hash, lockfile, or provenance-verification procedure. Consequently, the code installed in the future may differ from the dependency state intended when this skill was authored or audited.

npm packages can contain executable CLI code and installation lifecycle scripts. Global installation increases the package's reach within the user's environment. This dependency is particularly sensitive because the documented CLI participates in wallet authentication and escrow operations. The repository contains no package source, package manifest, or lockfile with which to verify the external implementation or its transitive dependencies.

This finding establishes an unsafe supply-chain practice; it does not establish that the current npm package is malicious.

### Attack Path

1. An attacker compromises the npm publisher account, package repository, release pipeline, or another relevant supply-chain component.
2. The attacker publishes a malicious release under the existing package name.
3. A user follows the skill's unversioned command, causing npm to resolve the attacker-controlled release.
4. npm installs the package globally and may execute package lifecycle scripts.
5. When the compromised CLI is invoked, it can access data provided to the process and manipulate wallet-authentication or escrow workflows.
6. The malicious implementation may exfiltrate session material, alter transaction parameters, or execute commands with the installing user's privileges.

### Impact Assessment

Successful exploitation could ex
...[truncated 771 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed exact version, such as:

  bash

  npm install -g @h1dr4/bountyhub-agent@0.1.7
  

• Publish and verify npm provenance attestations and document the expected publisher and repository.

• Provide a cryptographic integrity value or another authenticated verification method for the approved release.

• Supply a package manifest and lockfile where practical so direct and transitive dependency versions are reproducible.

• Prefer a project-local installation over a global installation to reduce system-wide exposure.

• Consider disabling lifecycle scripts during installation when compatible with the package:

  bash

  npm install --ignore-scripts @h1dr4/bountyhub-agent@0.1.7
  

• Review the package and its transitive dependencies before approving version updates.

• Require users to verify the destination address, network, asset, amount, and calldata independently before signing any transaction.

• Ensure session tokens and signatures are not written to command history, logs, or persistent plaintext storage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The skill instructs users to send wallet identifiers, authentication material, and later session-bearing requests to an external ACP endpoint. External transmission is expected for this integration, but it still carries security risk because sensitive workflow data and authentication context are sent to a remote service that must be trusted and protected; if the endpoint is compromised or spoofed, sessions and operational data could be abused.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

1. Get a login challenge:

bash

curl -s "$BOUNTYHUB_ACP_URL" \
  -H 'content-type: application/json' \
  -d '{"action":"auth.challenge","payload":{"wallet":"0xYOUR_WALLET"}}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The examples and action list describe mission creation with deposits and escrow claim/settle/cancel flows, but they do not explicitly warn that these operations can produce wallet-signing prompts and irreversible on-chain fund movements. In an agent skill context, that omission increases the chance a user or downstream agent triggers value-bearing transactions without adequate review, leading to unintended loss or transfer of funds.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest sets language: "en", which is a natural-language locale constraint. The file does not indicate that this is optional, user-selectable, or required for a region-specific purpose, so it appears to enforce a language policy without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.