hypha-payment

clawhub:hypha-payment

View source
B
75/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

3

Score

75/100

CRITICAL 1
LOW 2

Findings (3)

CRITICAL
Instruction override combined with dangerous operations
L1

Instruction override combined with dangerous operations

PRIVATE_KEY — Override wallet private key (instead of seed derivation)
FIX

Remove language that attempts to override safety guidelines or bypass system-level controls. This pattern is a strong indicator of a jailbreak attempt.

FP?

Likely FP if the matched text is in a security research document or educational content clearly marked as an example rather than an active payload.

LOW
pip install arbitrary package
L13

Detects pip install of arbitrary packages that modify the host environment

pip install hy
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.

LOW
pip install arbitrary package
L132

Detects pip install of arbitrary packages that modify the host environment

pip install hy
FIX

Pin all pip packages to exact versions (e.g., pip install package==1.2.3). Use a requirements.txt or pyproject.toml with pinned versions and hash verification.

FP?

Likely FP if the match is in documentation showing how to install the skill's own PyPI package.