aegis-security
2 findings (1 high, 1 medium), mainly social engineering, data exfiltration. Most recent scan 2026-02-05.
This skill presents MODERATE TO HIGH security risks primarily related to undisclosed financial transactions and external dependencies. The skill automatically sends cryptocurrency payments (USDC) to an external API service (aegis402.xyz) without prominent disclosure in the description. Critical payment library files (x402Client.py, x402HttpxClient.py, x402.py) are referenced but missing from the package, creating supply chain risks. The skill sends sensitive blockchain data (wallet addresses, transaction details) to an unverified third-party service. While the skill itself contains no malicious code (no scripts included), the lack of transparency about automatic payments, missing dependencies, and external data transmission creates significant user risk. The skill requires cryptocurrency wallet integration and funded accounts but does not clearly communicate these requirements upfront. Recommended actions: Add explicit payment disclosures, include all required dependencies, specify allowed-tools, and add user confirmation prompts before financial transactions.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Blockchain security API for AI agents. Scan tokens, simulate transactions, check addresses for threats.
- Package
- 2 files, 8.6 KB
- SKILL.md
- 876 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.0.0
- Homepage
- https://aegis402.xyz
SKILL.md covers: Aegis402 Shield Protocol · Skill Files · Quick Start · Pricing · Endpoints · Check Token ($0.01) · Check Address ($0.005) · Simulate Transaction ($0.05) · Payment Networks · TypeScript - Base/EVM · TypeScript - Solana · Python
Findings
HIGH Undisclosed Automatic Cryptocurrency Payment Mechanism Social Engineeringllm
The skill description states 'Blockchain security API for AI agents' but fails to prominently disclose that EVERY API call automatically sends cryptocurrency payments (USDC) to an external service. The payment mechanism is buried in code examples with the comment '// Payments happen automatically on Base (USDC)'. Users may not realize that using this skill will result in automatic financial transactions from their wallet. The pricing table shows costs ($0.005 to $0.05 per request), but the automatic nature and requirement for a funded wallet is not clearly stated in the description.
SKILL.md
Description: 'Blockchain security API for AI agents. Scan tokens, simulate transactions, check addresses for threats.' vs Reality: 'Pay-per-request with USDC on Base or Solana' with automatic payments. Code shows: 'const fetch402 = wrapFetchWithPayment(fetch, client);'MEDIUM External API Calls to Third-Party Service with Financial Data Data Exfiltrationllm
All API endpoints point to an external domain (https://aegis402.xyz/v1) that is not verified or audited. The skill sends transaction data, wallet addresses, and token information to this third-party service. Users have no visibility into what happens to this data after transmission. The service could log sensitive transaction details, wallet addresses, or use the data for purposes beyond the stated security checks.
api_base: 'https://aegis402.xyz/v1' - All endpoints use this external domain. Examples show sending wallet addresses: 'from': '0xYourWallet...', transaction data, and token addresses to external server.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 7.2 KB |
package.json | config | 1.4 KB |
External hosts referenced
aegis402.xyz docs.x402.org github.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/aegis-security
- Raw scan result: aegis-security-scan.json
- Badge for your README:
- Request a re-scan