# Buzzbysolcex Buzz Bd Agent Buzzshield

> BuzzShield — Crypto Agent Security Scanner

- Skill: `tomevault-io/buzzbysolcex-buzz-bd-agent-buzzshield` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/buzzbysolcex-buzz-bd-agent-buzzshield`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/buzzbysolcex-buzz-bd-agent-buzzshield/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/buzzbysolcex-buzz-bd-agent-buzzshield

---


# BuzzShield — Crypto Agent Security Scanner

> 47 crypto-specific rules. Scans CLAUDE.md, .env, hooks, agents, skills.
> Built on lessons from building a $0/day LLM cost production agent.

## When to Use

- Before deploying any crypto agent to production
- After adding new MCP servers or API keys
- Before hackathon submissions (catch leaks)
- As part of HSaaS security audit ($500 tier includes BuzzShield report)
- Periodic security hygiene check

## What It Scans

### 1. Secret Detection (14 patterns)

| Pattern                                    | What It Catches               |
| ------------------------------------------ | ----------------------------- |
| `0x[a-fA-F0-9]{64}`                        | Private keys (EVM)            |
| `[1-9A-HJ-NP-Za-km-z]{87,88}`              | Private keys (Solana)         |
| `sk-[a-zA-Z0-9]{48}`                       | API keys (Anthropic, OpenAI)  |
| `ghp_[a-zA-Z0-9]{36}`                      | GitHub personal access tokens |
| `xoxb-[0-9]{11}-[0-9]{13}-[a-zA-Z0-9]{24}` | Slack bot tokens              |
| `AKIA[0-9A-Z]{16}`                         | AWS access keys               |
| `fc-[a-f0-9]{32}`                          | Firecrawl API keys            |
| Mnemonic phrases                           | 12/24 word seed phrases       |
| `.env` in git                              | Uncommitted env files tracked |
| Hardcoded RPC URLs with API keys           | Alchemy, Infura, QuickNode    |
| `Bearer [a-zA-Z0-9._-]+`                   | Auth tokens in code           |
| Server IPs in public files                 | Infrastructure exposure       |
| OAuth client secrets                       | Google, GitHub OAuth          |
| Telegram bot tokens                        | Bot token patterns            |

### 2. Wallet Safety (9 patterns)

| Check                                          | Risk Level |
| ---------------------------------------------- | ---------- |
| Unprotected transfer_tokens calls              | CRITICAL   |
| Missing approval gate on swap operations       | CRITICAL   |
| Auto-approve at trust level 0                  | HIGH       |
| Wallet drain patterns (approve + transferFrom) | CRITICAL   |
| Missing amount limits on transactions          | HIGH       |
| Contract deployment without gas estimation     | MEDIUM     |
| Missing honeypot check before interaction      | HIGH       |
| Unverified contract addresses hardcoded        | MEDIUM     |
| Missing receipt/audit trail for transactions   | MEDIUM     |

### 3. Agent Config Review (12 patterns)

| Check                                              | Risk Level |
| -------------------------------------------------- | ---------- |
| `--dangerously-skip-permissions` without allowFrom | CRITICAL   |
| Missing requireMention in group configs            | HIGH       |
| Overly broad tool access in agent definitions      | MEDIUM     |
| MCP servers without rate limiting                  | MEDIUM     |
| Feature flags all TRUE (no safety gates)           | MEDIUM     |
| Missing trust gate on outreach operations          | HIGH       |
| Crons without maxRuns/expiresAt (infinite growth)  | HIGH       |
| Event handlers with side effects (recursive risk)  | MEDIUM     |
| Missing circuit breakers on mailbox                | HIGH       |
| Unvalidated task DAG dependencies (deadlock risk)  | MEDIUM     |
| server.js modifications without backup             | HIGH       |
| Gmail OAuth without CC enforcement                 | MEDIUM     |

### 4. Contract Security (7 patterns)

| Check                                        | Risk Level |
| -------------------------------------------- | ---------- |
| Deployer wallet used as contract owner       | CRITICAL   |
| EIP-7702 delegated wallet as owner           | CRITICAL   |
| Missing ownership transfer capability        | HIGH       |
| Unverified contract source on block explorer | MEDIUM     |
| Missing reentrancy guards                    | CRITICAL   |
| Unchecked external calls                     | HIGH       |
| Missing event emission on state changes      | MEDIUM     |

### 5. Infrastructure (5 patterns)

| Check                             | Risk Level |
| --------------------------------- | ---------- |
| Server IP in public content       | CRITICAL   |
| SSH keys in repository            | CRITICAL   |
| Docker socket exposed             | HIGH       |
| Missing fail2ban or rate limiting | MEDIUM     |
| Unencrypted database connections  | MEDIUM     |

## Output Format

### Terminal (default)

```
╔═══════════════════════════════════════╗
║  BUZZSHIELD SCAN REPORT — Grade: B+  ║
╚═══════════════════════════════════════╝

CRITICAL (0)  ✅ None found
HIGH     (2)  ⚠️
  → Missing honeypot check in /api/routes/swap.js:42
  → Cron job without expiresAt in /api/services/cron/jobs/token-scan.js:18
MEDIUM   (3)  ℹ️
  → Unverified contract address hardcoded in /api/lib/contracts.js:7
  → Feature flag WALLET_GUARD=false (governance disabled)
  → Missing rate limit on /api/score endpoint

Files scanned: 142
Rules checked: 47
Time: 2.3s
```

### JSON (CI/CD)

Exit code 2 on CRITICAL findings (build gate).

### Markdown (HSaaS reports)

Full report with remediation steps for each finding.

## Usage

### Via Claude Code

```
/security-scan                    # Quick scan
/security-scan --deep             # Include contract analysis
/security-scan --fix              # Auto-fix safe issues
/security-scan --report markdown  # Generate HSaaS report
```

### Via CLI

```bash
npx @buzzbd/shield scan
npx @buzzbd/shield scan --fix
npx @buzzbd/shield scan --format json
```

## How It Differs from AgentShield

| Feature         | AgentShield (ECC)    | BuzzShield (Buzz)               |
| --------------- | -------------------- | ------------------------------- |
| Focus           | Generic dev security | Crypto agent security           |
| Secret patterns | 14 generic           | 14 generic + 14 crypto-specific |
| Wallet checks   | None                 | 9 wallet safety rules           |
| Contract audit  | None                 | 7 smart contract patterns       |
| Trust system    | None                 | Trust gate verification         |
| On-chain        | None                 | Contract ownership checks       |
| Cost            | Free                 | Free (HSaaS report = $500)      |

## Architecture

BuzzShield runs entirely in Claude Code context — no external API calls.
It reads files via Bash/Grep/Glob tools and applies regex + heuristic rules.
Zero LLM cost for scanning. LLM used only for remediation suggestions.

---
> Source: [buzzbysolcex/buzz-bd-agent](https://github.com/buzzbysolcex/buzz-bd-agent) — distributed by [TomeVault](https://tomevault.io).
<!-- tomevault:4.0:skill_md:2026-06-16 -->