Skill Trust Decision
agent-guard
Skill delegates core functionality to an uninspectable external npm package with wallet-selling authority and version-only pinning, creating significant supply chain and credential handling risks not fully transparent in documentation.
Most direct threat evidence
01
User installs skill via clawhub Entry · SKILL.md
02
npm install fetches @hypelens/[email protected] from npm registry preparation · scripts/package.json
03
User runs setup with wallet key preparation · NAUTILUS-SIDECAR.md
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
1 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
4 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 5 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
User installs skill via clawhub
Entry · SKILL.md:1
02
npm install fetches @hypelens/[email protected] from npm registry
preparation · scripts/package.json:8
03
User runs setup with wallet key
preparation · NAUTILUS-SIDECAR.md:10
04
Scripts import and execute external npm package code with wallet authority
Execution · scripts/start-watcher.mjs:7
05
External package can execute protective SELLs or other blockchain transactions
Impact · node_modules/@hypelens/hypelens-agent-guard/:1
What drove the risk score up
Undeclared external code execution +25
SKILL.md describes 'setup' and 'watcher' commands but the actual execution logic is hidden in external npm package @hypelens/hypelens-agent-guard
Supply chain dependency +20
Package only version-pinned (0.1.18), not hash-pinned; npm can serve different content for same version
Undeclared wallet authority +15
Skill can execute protective SELLs against a funded wallet via AGENT_GUARD_EXIT_PK but this is buried in docs rather than declared upfront
Credential via environment +10
Private keys passed via AGENT_GUARD_EXIT_PK environment variable, documented as having live authority
Subprocess/shell execution +5
npx/npm execution paths present in documentation though reasonable for CLI tools
Most important evidence
High Supply Chain
External npm package with uninspectable code
Core functionality (setup, watcher, MCP) exists entirely in @hypelens/[email protected] which cannot be audited. Scripts are thin wrappers that import and execute this external package. Any malicious code in the npm package would execute with wallet-selling authority.
scripts/setup.mjs, scripts/start-mcp.mjs, scripts/start-watcher.mjs:1 Use npm pack + SHA256 verification, or vendor the relevant code directly in the skill
High Supply Chain
Version-only pinning without hash verification
package.json only specifies '@hypelens/hypelens-agent-guard': '0.1.18' without a commit hash or file hash. npm can serve different content for the same version number.
scripts/package.json:8 Pin to exact npm pack artifact with SHA256 or use a git submodule with pinned commit
Medium Doc Mismatch
Undeclared wallet-selling capability
SKILL.md focuses on 'stop loss' and 'risk management' framing but the skill can execute protective SELLs on Polymarket/Hyperliquid via AGENT_GUARD_EXIT_PK. This is documented in detail docs but not in SKILL.md frontmatter resource declarations.
SKILL.md:50 Add wallet-sell capability to SKILL.md metadata and clarify this is a trading agent with blockchain transaction authority
Medium Sensitive Access
Private key via environment variable with live authority
AGENT_GUARD_EXIT_PK environment variable grants the skill ability to SELL from the user's wallet. While skill-card.md mentions this, it's not declared as a capability.
NAUTILUS-SIDECAR.md:10 Document that this skill requires wallet private key access with transaction signing capability
Low Credential Theft
Private key potentially in shell history
Documentation suggests using export AGENT_GUARD_EXIT_PK=... which may leak to shell history. skill-card.md mentions this as a known risk.
NAUTILUS-SIDECAR.md:10 Use secret management tools instead of environment variable exports in shell
Declared capability vs actual capability
Filesystem Pass
Declared NONE
→ Inferred WRITE
SKILL.md: writes state/heartbeat.json, config files via setup Network Pass
Declared NONE
→ Inferred READ
External npm package likely makes API calls; not declared in SKILL.md Shell Pass
Declared WRITE
→ Inferred —
npm/npx commands documented; requires node, npm binaries Environment Block
Declared NONE
→ Inferred ADMIN
AGENT_GUARD_EXIT_PK and AGENT_GUARD_HL_PK env vars with wallet authority; not declared in SKILL.md resource section Skill Invoke Pass
Declared READ
→ Inferred —
MCP heartbeat/guard_status documented Suspicious artifacts and egress
Medium External URL
https://nautilustrader.io/docs/latest/integrations/polymarket/ NAUTILUS-SIDECAR.md:36
Medium Wallet Address
0x9548B8E9554a1968843B3C380431b10996247c88 SKILL.md:95
Medium External URL
https://clawhub.ai/user/polyparlay skill-card.md:9
Medium External URL
https://clawhub.ai/polyparlay/skills/agent-guard skill-card.md:39
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| @hypelens/hypelens-agent-guard | 0.1.18 | npm | No | Version-only pinned; code cannot be audited in skill scope; has wallet-selling authority |
File composition
10 files · 367 lines
Markdown 5 files · 267 linesJavaScript 3 files · 86 linesJSON 2 files · 14 lines
Files of concern · 4
SKILL.md Undeclared wallet-selling capability · 0x9548B8E9554a1968843B3C380431b10996247c88
NAUTILUS-SIDECAR.md Private key via environment variable with live authority · Private key potentially in shell history · https://nautilustrader.io/docs/latest/integrations/polymarket/
skill-card.md https://clawhub.ai/user/polyparlay · https://clawhub.ai/polyparlay/skills/agent-guard
scripts/package.json Version-only pinning without hash verification
Other files · BOT.md · start-mcp.mjs · start-watcher.mjs · setup.mjs · ELIZA-COMPANION.md · _meta.json
Security positives
Skill-card.md acknowledges wallet-selling risk explicitly with mitigations
Uses dry-run mode by default; live mode requires explicit EXIT_PK
MIT-0 license allows audit and modification
Known publisher (polyparlay) on ClawHub with verifiable profile