agent-guard

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:27 AM UTC
• Version: 1.0.25

Overview

This skill is a real trading guard, but it asks users to run a long-lived external package with wallet-selling authority and can move from dry-run to live exits too easily.

Review this carefully before installing. Only use it with a dedicated, least-privilege exit key, start in dry-run, verify the exact npm artifact and launcher path, avoid storing private keys in shell history or compose files, and do not allow broad agent auto-routing to live-arm exits without an explicit human confirmation.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/package.json:1

Finding

Security-Critical Trading Logic Is Delegated to an Unverified Third-Party Package

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/setup.mjs:10

Finding

Executable Fallback Paths Allow Code Loading from Outside the Project Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · NAUTILUS-SIDECAR.md (reported line 17)May include surrounding context.

bash

mkdir -p pm-stops-sidecar && cd pm-stops-sidecar
npm pack @hypelens/hypelens-agent-guard@0.1.18 && tar -xzf hypelens-hypelens-agent-guard-0.1.18.tgz
cp -r package/compose/* . && rm -rf package *.tgz
export FUNDER=0xYourFunder EXIT_PK=0xYourExitKey
./up.sh
# or: docker compose up -d --build

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that if EXIT private-key environment variables are present, setup auto-flips exits.dryRun to false and can live-arm protective exits automatically. In this context, automatic transition from simulation to live trading based solely on environment state is dangerous because users or agents may unknowingly execute real market orders or flatten positions without an explicit, contemporaneous confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instructions ask the user to export AGENT_GUARD_EXIT_PK and note that it can sell funder positions, but they do not clearly warn that this is a highly sensitive private key granting real trading authority. In this skill’s context, mishandling that environment variable, pasting it into shells, compose files, logs, or shared hosts could directly expose control over user positions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup steps tell users to disable dry-run and then launch the watcher, enabling automatic protective SELLs, but they do not prominently warn that this causes immediate live trading behavior. Because the tool acts outside the primary trading system and can auto-exit positions on breach logic, misconfiguration or misunderstanding could trigger unintended liquidations and financial loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation frames the sidecar not only as a risk-control tool but also as a way to stamp builder codes and capture fee attribution. That expands the operator’s incentive from pure safety automation into live order-flow manipulation for attribution, which can encourage deployment with live keys and trading authority even when risk controls are not the primary objective.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Calling the sidecar 'protective' while also recommending it for attribution and fee capture can mislead users about its true behavior and trust boundary. In this context, the tool is authorized to submit live SELL orders, so underselling the revenue-seeking/trading aspects increases the risk that users grant sensitive credentials without fully understanding the non-protective incentives involved.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This is the same unpinned runtime package execution in the Docker compose command path. Because the watcher is described as able to place protective SELLs and consume AGENT_GUARD_EXIT_PK, executing an unpinned registry-fetched binary materially increases supply-chain risk and could turn into direct fund loss.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The skill instructs users to execute an npm package via npx, which can fetch and run remote code at install/runtime. Although the package version is pinned in some commands, the manifest-level reference identified by the scanner is effectively an executable dependency path and creates supply-chain risk if users or tooling invoke the unpinned form or trust the skill to launch it automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and recommendations use very broad triggers such as generic trading/risk terms and ecosystem names, which can cause the skill to activate in contexts far beyond explicit user intent. In a high-risk trading environment, this can steer agents into operational flows involving wallets, exits, and live protections when the user only asked a general question, increasing the chance of unintended action chaining.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The keyword list is excessively broad and includes generic terms like 'go live', 'heartbeat', 'mcp', 'docker-compose', and vendor/project names that are not specific to this skill's safe use. This increases the attack surface for prompt-routing and accidental invocation, especially because the skill discusses live trading protections and environment-driven arming behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.