📦
Audit History
antseed-connect - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 02:51 AM
Most static matches are documentation syntax, loopback endpoints, local configuration paths, or non-secret placeholder values. Four findings are confirmed because the skill instructs users to generate, store, and use a funded EVM hot-wallet identity; the accompanying safeguards reduce but do not eliminate the impact of compromise. Static review was capped at 400/648 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
1
Files scanned
1,373
Lines analyzed
8
Review items
0
False positives ignored
Confirmed security concerns (4)
High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
This line identifies the AntSeed identity as a hot wallet key. Mishandling the key can expose funds, even though the documentation warns against disclosure.
High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The documented identity.key file contains a raw EVM private key. A compromised file can expose the buyer wallet and its USDC deposits.
High
Crypto seed/private key mention
# 2. Identity (an EVM private key — 64 hex chars). Save this somewhere safe;
The setup directs users to generate and export an EVM private key. Exposure of this hot-wallet identity could permit access to funded deposits.
High
Crypto seed/private key mention
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The documentation describes identity.key as a raw EVM private key. Its loss or disclosure can compromise the associated buyer wallet.
Risk Factors
⚙️ External commands (50)
SKILL.md:16 SKILL.md:21 SKILL.md:28 SKILL.md:32 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:50 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:60 SKILL.md:61 SKILL.md:65 SKILL.md:73 SKILL.md:77-92 SKILL.md:92 SKILL.md:94 SKILL.md:111-112 SKILL.md:112-113 SKILL.md:113 SKILL.md:138 SKILL.md:147-151 SKILL.md:151 SKILL.md:153 SKILL.md:154-158 SKILL.md:158-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-169 SKILL.md:169-170 SKILL.md:170-172 SKILL.md:172-175 SKILL.md:175-182 SKILL.md:182-183 SKILL.md:183 SKILL.md:185-187 SKILL.md:187-193 SKILL.md:193-198 SKILL.md:198-202 SKILL.md:202-206 SKILL.md:206-208 SKILL.md:208-209 SKILL.md:209-210 SKILL.md:210-214
🌐 Network access (50)
SKILL.md:8 SKILL.md:16 SKILL.md:71 SKILL.md:73 SKILL.md:143 SKILL.md:194 SKILL.md:277 SKILL.md:279 SKILL.md:310 SKILL.md:313 SKILL.md:327 SKILL.md:347 SKILL.md:360 SKILL.md:361 SKILL.md:372 SKILL.md:374 SKILL.md:403 SKILL.md:410 SKILL.md:428 SKILL.md:445 SKILL.md:452 SKILL.md:457 SKILL.md:474 SKILL.md:475 SKILL.md:486 SKILL.md:488 SKILL.md:519 SKILL.md:525 SKILL.md:542 SKILL.md:548 SKILL.md:580 SKILL.md:581 SKILL.md:592 SKILL.md:594 SKILL.md:596 SKILL.md:598 SKILL.md:600 SKILL.md:623 SKILL.md:628 SKILL.md:650 SKILL.md:659 SKILL.md:670 SKILL.md:671 SKILL.md:672 SKILL.md:683 SKILL.md:685 SKILL.md:689 SKILL.md:708 SKILL.md:742 SKILL.md:748
📁 Filesystem access (50)
SKILL.md:907 SKILL.md:1002 SKILL.md:57 SKILL.md:151 SKILL.md:183 SKILL.md:206 SKILL.md:208 SKILL.md:225 SKILL.md:259 SKILL.md:374 SKILL.md:380 SKILL.md:401 SKILL.md:414 SKILL.md:422 SKILL.md:437 SKILL.md:452 SKILL.md:456 SKILL.md:457 SKILL.md:458 SKILL.md:459 SKILL.md:461 SKILL.md:517 SKILL.md:566 SKILL.md:685 SKILL.md:687 SKILL.md:699 SKILL.md:703 SKILL.md:799 SKILL.md:801 SKILL.md:813 SKILL.md:817 SKILL.md:879 SKILL.md:57 SKILL.md:151 SKILL.md:183 SKILL.md:206 SKILL.md:208 SKILL.md:225 SKILL.md:259 SKILL.md:374 SKILL.md:380 SKILL.md:401 SKILL.md:414 SKILL.md:422 SKILL.md:437 SKILL.md:452 SKILL.md:456 SKILL.md:457 SKILL.md:458 SKILL.md:459
Audited by: claude
Jul 9, 2026, 11:50 PM
The skill is legitimate integration documentation, but it handles sensitive wallet identity material, persistent agent configuration, sudo service control, and paid P2P inference routing. Most static URL, Markdown backtick, and placeholder API-key matches are false positives, but several findings are confirmed because they affect funds, secrets, or persistent routing. Static review was capped at 400/648 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
1
Files scanned
1,373
Lines analyzed
66
Review items
0
False positives ignored
Confirmed security concerns (10)
High
Certificate/key files
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The text references AntSeed wallet identity key material. Exposure or mishandling could compromise the buyer identity and deposits.
High
Certificate/key files
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The text references AntSeed wallet identity key material. Exposure or mishandling could compromise the buyer identity and deposits.
High
Certificate/key files
| `identity.enc` | Encrypted copy of `identity.key` (when the desktop app sets a passphrase). | yes
The text references AntSeed wallet identity key material. Exposure or mishandling could compromise the buyer identity and deposits.
High
Crypto seed/private key mention
# 2. Identity (an EVM private key — 64 hex chars). Save this somewhere safe;
The text explicitly describes an EVM private key or identity.key file used for the buyer wallet. That key controls access to deposits.
High
Crypto seed/private key mention
| `identity.key` | Raw 32-byte EVM private key for the buyer wallet. Fallback when `ANTSEED_IDENTITY
The text explicitly describes an EVM private key or identity.key file used for the buyer wallet. That key controls access to deposits.
High
Prompt Data Routed To Peer Providers
The skill routes model requests from local tools to AntSeed peers. Prompts, tool context, and metadata may reach third-party providers.
The prose states that the buyer proxy forwards requests to peers selling inference. This is clear privacy and routing context beyond a single URL match.
High
Hot Wallet And Paid Usage Risk
The setup creates or uses a buyer identity key and supports USDC-funded paid services. Autonomous use can expose funds to spending or key-loss risk.
The file directly ties the identity key to USDC deposits and documents paid services. This is a business-logic risk static patterns only partially capture.
High
Persistent Agent Routing Configuration
The skill tells agents to create or edit user-level configs that persistently route future AI tool traffic through AntSeed.
The instructions explicitly merge provider blocks into user-level Codex, OpenClaw, and Hermes configs. This can change future model routing.
Medium
SQLite database file
| `metering.db` | SQLite log of every request the proxy served (model, peer, tokens, USDC). Used by
The metering.db file stores local request, peer, token, and USDC usage metadata. That history can be sensitive.
Medium
Third-Party Install Supply Chain Risk
The setup includes global npm packages and a Pi extension installed from GitHub. These installs can execute third-party code on the user machine.
The install commands are explicit and use external package sources. The risk is supply-chain exposure, not a malicious payload proven in this file.
Capability review items (52)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
No real Anthropic API key is needed — the AntSeed proxy authenticates each request with your local i
The environment variable names the AntSeed buyer identity key. If exposed, it can compromise the wallet-backed buyer identity.
High
Generic API/secret keys
**TL;DR for agents:** Install Pi: `npm install -g @mariozechner/pi-coding-agent`. Install the AntSee
The text discusses an optional auth token for a proxied buyer endpoint. This may be a real secret in some deployments.
High
Generic API/secret keys
> No GUI config needed in the common case — the extension reads `ANTSEED_BASE_URL` (default `http://
The text discusses an optional auth token for a proxied buyer endpoint. This may be a real secret in some deployments.
High
Generic API/secret keys
- *Want to use a custom buyer proxy URL (remote host, custom port)* — Set `ANTSEED_BASE_URL=http://y
The text discusses an optional auth token for a proxied buyer endpoint. This may be a real secret in some deployments.
High
Hidden file in home directory
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The path points to the AntSeed wallet identity key in the user home directory. This is sensitive key material.
High
Hidden file in home directory
```json title="~/.antseed/config.json"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
rm ~/.antseed/buyer.state.json
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
**TL;DR for agents:** Prefer `antseed codex --model <service-id>`. It injects the AntSeed Codex prov
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
If you prefer a persistent manual setup, create `~/.codex/antseed.config.toml` and launch Codex with
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
```toml title="~/.codex/antseed.config.toml"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
_Manual profile only: this must be your **user-level** `~/.codex/antseed.config.toml`, then launch w
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
Pass the peer service id to `antseed codex --model <service-id>`. For a manual profile, set top-leve
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
> Whatever appears here is a valid value for top-level `model = ...` in `~/.codex/antseed.config.tom
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
- *`OPENAI_BASE_URL` / `OPENAI_API_KEY` are being ignored* — Expected on recent Codex builds. Use `a
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
- *Codex prints `Ignored unsupported project-local config keys ... model_provider, model_providers`*
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
- *Hand-written Codex `-c` provider overrides behave inconsistently* — Use `antseed codex --model <s
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
- *`unknown profile: antseed`* — Codex caches profile config on launch. Make sure you saved `~/.code
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
```json title="opencode.json (project root, or ~/.config/opencode/opencode.json for global)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
- *AntSeed doesn't appear in `/connect` or `/models`* — With `antseed opencode`, pass the service id
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
**TL;DR for agents:** Edit ~/.openclaw/openclaw.json: under models.providers, add an `antseed` entry
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
**What OpenClaw is.** OpenClaw is an open-source agent runtime for autonomous, long-running tasks (r
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
```json title="~/.openclaw/openclaw.json (merge into the existing `models.providers` object)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
**TL;DR for agents:** Edit ~/.hermes/config.yaml: add a `custom_providers` entry named `antseed` wit
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
**What Hermes is.** Hermes is the agent framework from [Nous Research](https://nousresearch.com/) (s
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
> Hermes is typically run as a long-lived process (often under systemd on a server). The config file
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
Hidden file in home directory
```yaml title="~/.hermes/config.yaml (merge into your existing config)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
High
sudo privilege escalation
sudo systemctl restart hermes
The skill instructs sudo commands to restart or inspect Hermes. Elevated commands require explicit user approval.
High
sudo privilege escalation
> Or whatever supervisor you use. Then check the journal: `sudo journalctl -u hermes --no-pager -n 3
The skill instructs sudo commands to restart or inspect Hermes. Elevated commands require explicit user approval.
High
sudo privilege escalation
- *Want to swap the routed model without restarting AntSeed* — Edit `model.default` (and `models:` i
The skill instructs sudo commands to restart or inspect Hermes. Elevated commands require explicit user approval.
High
Hidden file access
- Treat `ANTSEED_IDENTITY_HEX` / `~/.antseed/identity.key` as a hot wallet key.
The path points to the AntSeed wallet identity key in the user home directory. This is sensitive key material.
High
Shell command substitution
export ANTSEED_IDENTITY_HEX=$(openssl rand -hex 32)
The command generates and exports a wallet identity value using shell substitution. This handles sensitive key material.
Medium
Hidden file access
```json title="~/.antseed/config.json"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
rm ~/.antseed/buyer.state.json
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
**TL;DR for agents:** Prefer `antseed codex --model <service-id>`. It injects the AntSeed Codex prov
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
If you prefer a persistent manual setup, create `~/.codex/antseed.config.toml` and launch Codex with
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
```toml title="~/.codex/antseed.config.toml"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
_Manual profile only: this must be your **user-level** `~/.codex/antseed.config.toml`, then launch w
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
Pass the peer service id to `antseed codex --model <service-id>`. For a manual profile, set top-leve
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
> Whatever appears here is a valid value for top-level `model = ...` in `~/.codex/antseed.config.tom
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
- *`OPENAI_BASE_URL` / `OPENAI_API_KEY` are being ignored* — Expected on recent Codex builds. Use `a
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
- *Codex prints `Ignored unsupported project-local config keys ... model_provider, model_providers`*
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
- *Hand-written Codex `-c` provider overrides behave inconsistently* — Use `antseed codex --model <s
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
- *`unknown profile: antseed`* — Codex caches profile config on launch. Make sure you saved `~/.code
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
```json title="opencode.json (project root, or ~/.config/opencode/opencode.json for global)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
- *AntSeed doesn't appear in `/connect` or `/models`* — With `antseed opencode`, pass the service id
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
**TL;DR for agents:** Edit ~/.openclaw/openclaw.json: under models.providers, add an `antseed` entry
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
**What OpenClaw is.** OpenClaw is an open-source agent runtime for autonomous, long-running tasks (r
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
```json title="~/.openclaw/openclaw.json (merge into the existing `models.providers` object)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
**TL;DR for agents:** Edit ~/.hermes/config.yaml: add a `custom_providers` entry named `antseed` wit
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
**What Hermes is.** Hermes is the agent framework from [Nous Research](https://nousresearch.com/) (s
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
> Hermes is typically run as a long-lived process (often under systemd on a server). The config file
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Medium
Hidden file access
```yaml title="~/.hermes/config.yaml (merge into your existing config)"
The skill instructs persistent user-level agent or proxy configuration changes. Those changes can reroute future model traffic.
Risk Factors
⚙️ External commands (50)
SKILL.md:16 SKILL.md:21 SKILL.md:28 SKILL.md:32 SKILL.md:35 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:39 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:50 SKILL.md:56 SKILL.md:57 SKILL.md:58 SKILL.md:60 SKILL.md:61 SKILL.md:65 SKILL.md:73 SKILL.md:77-92 SKILL.md:92 SKILL.md:94 SKILL.md:111-112 SKILL.md:112-113 SKILL.md:113 SKILL.md:138 SKILL.md:147-151 SKILL.md:151 SKILL.md:153 SKILL.md:154-158 SKILL.md:158-165 SKILL.md:165-166 SKILL.md:166-167 SKILL.md:167-169 SKILL.md:169-170 SKILL.md:170-172 SKILL.md:172-175 SKILL.md:175-182 SKILL.md:182-183 SKILL.md:183 SKILL.md:185-187 SKILL.md:187-193 SKILL.md:193-198 SKILL.md:198-202 SKILL.md:202-206 SKILL.md:206-208 SKILL.md:208-209 SKILL.md:209-210 SKILL.md:210-214
🌐 Network access (50)
SKILL.md:8 SKILL.md:16 SKILL.md:71 SKILL.md:73 SKILL.md:143 SKILL.md:194 SKILL.md:277 SKILL.md:279 SKILL.md:310 SKILL.md:313 SKILL.md:327 SKILL.md:347 SKILL.md:360 SKILL.md:361 SKILL.md:372 SKILL.md:374 SKILL.md:403 SKILL.md:410 SKILL.md:428 SKILL.md:445 SKILL.md:452 SKILL.md:457 SKILL.md:474 SKILL.md:475 SKILL.md:486 SKILL.md:488 SKILL.md:519 SKILL.md:525 SKILL.md:542 SKILL.md:548 SKILL.md:580 SKILL.md:581 SKILL.md:592 SKILL.md:594 SKILL.md:596 SKILL.md:598 SKILL.md:600 SKILL.md:623 SKILL.md:628 SKILL.md:650 SKILL.md:659 SKILL.md:670 SKILL.md:671 SKILL.md:672 SKILL.md:683 SKILL.md:685 SKILL.md:689 SKILL.md:708 SKILL.md:742 SKILL.md:748
📁 Filesystem access (50)
SKILL.md:907 SKILL.md:1002 SKILL.md:57 SKILL.md:151 SKILL.md:183 SKILL.md:206 SKILL.md:208 SKILL.md:225 SKILL.md:259 SKILL.md:374 SKILL.md:380 SKILL.md:401 SKILL.md:414 SKILL.md:422 SKILL.md:437 SKILL.md:452 SKILL.md:456 SKILL.md:457 SKILL.md:458 SKILL.md:459 SKILL.md:461 SKILL.md:517 SKILL.md:566 SKILL.md:685 SKILL.md:687 SKILL.md:699 SKILL.md:703 SKILL.md:799 SKILL.md:801 SKILL.md:813 SKILL.md:817 SKILL.md:879 SKILL.md:57 SKILL.md:151 SKILL.md:183 SKILL.md:206 SKILL.md:208 SKILL.md:225 SKILL.md:259 SKILL.md:374 SKILL.md:380 SKILL.md:401 SKILL.md:414 SKILL.md:422 SKILL.md:437 SKILL.md:452 SKILL.md:456 SKILL.md:457 SKILL.md:458 SKILL.md:459
Audited by: codex