buzzbysolcex BuzzShield — Crypto Agent Security Scanner
47 crypto-specific rules. Scans CLAUDE.md, .env, hooks, agents, skills. Built on lessons from building a $0/day LLM cost production agent.
When to Use
- Before deploying any crypto agent to production
- After adding new MCP servers or API keys
- Before hackathon submissions (catch leaks)
- As part of HSaaS security audit ($500 tier includes BuzzShield report)
- Periodic security hygiene check
What It Scans
1. Secret Detection (14 patterns)
| Pattern | What It Catches |
|---|---|
0x[a-fA-F0-9]{64} |
Private keys (EVM) |
[1-9A-HJ-NP-Za-km-z]{87,88} |
Private keys (Solana) |
sk-[a-zA-Z0-9]{48} |
API keys (Anthropic, OpenAI) |
ghp_[a-zA-Z0-9]{36} |
GitHub personal access tokens |
xoxb-[0-9]{11}-[0-9]{13}-[a-zA-Z0-9]{24} |
Slack bot tokens |
AKIA[0-9A-Z]{16} |
AWS access keys |
fc-[a-f0-9]{32} |
Firecrawl API keys |
| Mnemonic phrases | 12/24 word seed phrases |
.env in git |
Uncommitted env files tracked |
| Hardcoded RPC URLs with API keys | Alchemy, Infura, QuickNode |
Bearer [a-zA-Z0-9._-]+ |
Auth tokens in code |
| Server IPs in public files | Infrastructure exposure |
| OAuth client secrets | Google, GitHub OAuth |
| Telegram bot tokens | Bot token patterns |
2. Wallet Safety (9 patterns)
| Check | Risk Level |
|---|---|
| Unprotected transfer_tokens calls | CRITICAL |
| Missing approval gate on swap operations | CRITICAL |
| Auto-approve at trust level 0 | HIGH |
| Wallet drain patterns (approve + transferFrom) | CRITICAL |
| Missing amount limits on transactions | HIGH |
| Contract deployment without gas estimation | MEDIUM |
| Missing honeypot check before interaction | HIGH |
| Unverified contract addresses hardcoded | MEDIUM |
| Missing receipt/audit trail for transactions | MEDIUM |
3. Agent Config Review (12 patterns)
| Check | Risk Level |
|---|---|
--dangerously-skip-permissions without allowFrom |
CRITICAL |
| Missing requireMention in group configs | HIGH |
| Overly broad tool access in agent definitions | MEDIUM |
| MCP servers without rate limiting | MEDIUM |
| Feature flags all TRUE (no safety gates) | MEDIUM |
| Missing trust gate on outreach operations | HIGH |
| Crons without maxRuns/expiresAt (infinite growth) | HIGH |
| Event handlers with side effects (recursive risk) | MEDIUM |
| Missing circuit breakers on mailbox | HIGH |
| Unvalidated task DAG dependencies (deadlock risk) | MEDIUM |
| server.js modifications without backup | HIGH |
| Gmail OAuth without CC enforcement | MEDIUM |
4. Contract Security (7 patterns)
| Check | Risk Level |
|---|---|
| Deployer wallet used as contract owner | CRITICAL |
| EIP-7702 delegated wallet as owner | CRITICAL |
| Missing ownership transfer capability | HIGH |
| Unverified contract source on block explorer | MEDIUM |
| Missing reentrancy guards | CRITICAL |
| Unchecked external calls | HIGH |
| Missing event emission on state changes | MEDIUM |
5. Infrastructure (5 patterns)
| Check | Risk Level |
|---|---|
| Server IP in public content | CRITICAL |
| SSH keys in repository | CRITICAL |
| Docker socket exposed | HIGH |
| Missing fail2ban or rate limiting | MEDIUM |
| Unencrypted database connections | MEDIUM |
Output Format
Terminal (default)
╔═══════════════════════════════════════╗
║ BUZZSHIELD SCAN REPORT — Grade: B+ ║
╚═══════════════════════════════════════╝
CRITICAL (0) ✅ None found
HIGH (2) ⚠️
→ Missing honeypot check in /api/routes/swap.js:42
→ Cron job without expiresAt in /api/services/cron/jobs/token-scan.js:18
MEDIUM (3) ℹ️
→ Unverified contract address hardcoded in /api/lib/contracts.js:7
→ Feature flag WALLET_GUARD=false (governance disabled)
→ Missing rate limit on /api/score endpoint
Files scanned: 142
Rules checked: 47
Time: 2.3s
JSON (CI/CD)
Exit code 2 on CRITICAL findings (build gate).
Markdown (HSaaS reports)
Full report with remediation steps for each finding.
Usage
Via Claude Code
/security-scan # Quick scan
/security-scan --deep # Include contract analysis
/security-scan --fix # Auto-fix safe issues
/security-scan --report markdown # Generate HSaaS report
Via CLI
npx @buzzbd/shield scan
npx @buzzbd/shield scan --fix
npx @buzzbd/shield scan --format json
How It Differs from AgentShield
| Feature | AgentShield (ECC) | BuzzShield (Buzz) |
|---|---|---|
| Focus | Generic dev security | Crypto agent security |
| Secret patterns | 14 generic | 14 generic + 14 crypto-specific |
| Wallet checks | None | 9 wallet safety rules |
| Contract audit | None | 7 smart contract patterns |
| Trust system | None | Trust gate verification |
| On-chain | None | Contract ownership checks |
| Cost | Free | Free (HSaaS report = $500) |
Architecture
BuzzShield runs entirely in Claude Code context — no external API calls. It reads files via Bash/Grep/Glob tools and applies regex + heuristic rules. Zero LLM cost for scanning. LLM used only for remediation suggestions.