中文 EN
开始可信审查
安全决策报告

agent-guard

Skill delegates core functionality to an uninspectable external npm package with wallet-selling authority and version-only pinning, creating significant supply chain and credential handling risks not fully transparent in documentation.

安装决策优先 来源: ClawHub 扫描时间: 2026/9/19
文件 10
IOC 4
越权项 1
发现 5
最直接的威胁证据
01
User installs skill via clawhub 初始入口 · SKILL.md
02
npm install fetches @hypelens/[email protected] from npm registry preparation · scripts/package.json
03
User runs setup with wallet key preparation · NAUTILUS-SIDECAR.md

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 1 项声明之外的能力或越权行为。

复核
隐藏执行与外联

提取到 4 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 5 步攻击链，另有 2 项高危或严重发现。

复核
依赖与供应链卫生

发现 1 项需要关注的依赖或供应链线索。

攻击链

01
User installs skill via clawhub

初始入口 · SKILL.md:1

02
npm install fetches @hypelens/[email protected] from npm registry

preparation · scripts/package.json:8

03
User runs setup with wallet key

preparation · NAUTILUS-SIDECAR.md:10

04
Scripts import and execute external npm package code with wallet authority

代码执行 · scripts/start-watcher.mjs:7

05
External package can execute protective SELLs or other blockchain transactions

最终危害 · node_modules/@hypelens/hypelens-agent-guard/:1

风险分是怎么被拉高的

Undeclared external code execution +25

SKILL.md describes 'setup' and 'watcher' commands but the actual execution logic is hidden in external npm package @hypelens/hypelens-agent-guard

Supply chain dependency +20

Package only version-pinned (0.1.18), not hash-pinned; npm can serve different content for same version

Undeclared wallet authority +15

Skill can execute protective SELLs against a funded wallet via AGENT_GUARD_EXIT_PK but this is buried in docs rather than declared upfront

Credential via environment +10

Private keys passed via AGENT_GUARD_EXIT_PK environment variable, documented as having live authority

Subprocess/shell execution +5

npx/npm execution paths present in documentation though reasonable for CLI tools

最关键的证据

高危 供应链

External npm package with uninspectable code

Core functionality (setup, watcher, MCP) exists entirely in @hypelens/[email protected] which cannot be audited. Scripts are thin wrappers that import and execute this external package. Any malicious code in the npm package would execute with wallet-selling authority.

scripts/setup.mjs, scripts/start-mcp.mjs, scripts/start-watcher.mjs:1
Use npm pack + SHA256 verification, or vendor the relevant code directly in the skill
高危 供应链

Version-only pinning without hash verification

package.json only specifies '@hypelens/hypelens-agent-guard': '0.1.18' without a commit hash or file hash. npm can serve different content for the same version number.

scripts/package.json:8
Pin to exact npm pack artifact with SHA256 or use a git submodule with pinned commit
中危 文档欺骗

Undeclared wallet-selling capability

SKILL.md focuses on 'stop loss' and 'risk management' framing but the skill can execute protective SELLs on Polymarket/Hyperliquid via AGENT_GUARD_EXIT_PK. This is documented in detail docs but not in SKILL.md frontmatter resource declarations.

SKILL.md:50
Add wallet-sell capability to SKILL.md metadata and clarify this is a trading agent with blockchain transaction authority
中危 敏感访问

Private key via environment variable with live authority

AGENT_GUARD_EXIT_PK environment variable grants the skill ability to SELL from the user's wallet. While skill-card.md mentions this, it's not declared as a capability.

NAUTILUS-SIDECAR.md:10
Document that this skill requires wallet private key access with transaction signing capability
低危 凭证窃取

Private key potentially in shell history

Documentation suggests using export AGENT_GUARD_EXIT_PK=... which may leak to shell history. skill-card.md mentions this as a known risk.

NAUTILUS-SIDECAR.md:10
Use secret management tools instead of environment variable exports in shell

声明能力 vs 实际能力

文件系统 通过
声明 NONE
→
推断 WRITE
SKILL.md: writes state/heartbeat.json, config files via setup
网络访问 通过
声明 NONE
→
推断 READ
External npm package likely makes API calls; not declared in SKILL.md
命令执行 通过
声明 WRITE
→
推断 —
npm/npx commands documented; requires node, npm binaries
环境变量 阻止
声明 NONE
→
推断 ADMIN
AGENT_GUARD_EXIT_PK and AGENT_GUARD_HL_PK env vars with wallet authority; not declared in SKILL.md resource section
技能调用 通过
声明 READ
→
推断 —
MCP heartbeat/guard_status documented

可疑产物与外联

中危 外部 URL
https://nautilustrader.io/docs/latest/integrations/polymarket/

NAUTILUS-SIDECAR.md:36

中危 钱包地址
0x9548B8E9554a1968843B3C380431b10996247c88

SKILL.md:95

中危 外部 URL
https://clawhub.ai/user/polyparlay

skill-card.md:9

中危 外部 URL
https://clawhub.ai/polyparlay/skills/agent-guard

skill-card.md:39

依赖与供应链

包名版本来源漏洞备注
@hypelens/hypelens-agent-guard 0.1.18 npm 否 Version-only pinned; code cannot be audited in skill scope; has wallet-selling authority

文件构成

10 个文件 · 367 行
Markdown 5 个文件 · 267 行JavaScript 3 个文件 · 86 行JSON 2 个文件 · 14 行
需关注文件 · 4
SKILL.md Markdown · 110 行
Undeclared wallet-selling capability · 0x9548B8E9554a1968843B3C380431b10996247c88
NAUTILUS-SIDECAR.md Markdown · 70 行
Private key via environment variable with live authority · Private key potentially in shell history · https://nautilustrader.io/docs/latest/integrations/polymarket/
skill-card.md Markdown · 60 行
https://clawhub.ai/user/polyparlay · https://clawhub.ai/polyparlay/skills/agent-guard
scripts/package.json JSON · 9 行
Version-only pinning without hash verification
其他文件 · BOT.md · start-mcp.mjs · start-watcher.mjs · setup.mjs · ELIZA-COMPANION.md · _meta.json

安全亮点

Skill-card.md acknowledges wallet-selling risk explicitly with mitigations
Uses dry-run mode by default; live mode requires explicit EXIT_PK
MIT-0 license allows audit and modification
Known publisher (polyparlay) on ClawHub with verifiable profile