Security audit

Krypton Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about managing Kryptone/PrivacyEscrow trades, but it lets an agent perform high-impact USDC escrow actions with an API key and limited confirmation safeguards.

Install only if you trust the publisher and the Kryptone/PrivacyEscrow server. Inject AGENT_API_KEY only for this skill, set KRYPTONE_API_BASE_URL explicitly, rotate the key if exposed, and require manual review of trade ID, role, counterparty, and USDC amount before creating, accepting, submitting signatures for, or settling trades.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/http.js:2