BuzzShield — Crypto Agent Security Scanner
47 crypto-specific rules. Scans CLAUDE.md, .env, hooks, agents, skills.
Built on lessons from building a $0/day LLM cost production agent.
When to Use
- Before deploying any crypto agent to production
- After adding new MCP servers or API keys
- Before hackathon submissions (catch leaks)
- As part of HSaaS security audit ($500 tier includes BuzzShield report)
- Periodic security hygiene check
What It Scans
1. Secret Detection (14 patterns)
| Pattern |
What It Catches |
0x[a-fA-F0-9]{64} |
Private keys (EVM) |
[1-9A-HJ-NP-Za-km-z]{87,88} |
Private keys (Solana) |
sk-[a-zA-Z0-9]{48} |
API keys (Anthropic, OpenAI) |
ghp_[a-zA-Z0-9]{36} |
GitHub personal access tokens |
xoxb-[0-9]{11}-[0-9]{13}-[a-zA-Z0-9]{24} |
Slack bot tokens |
AKIA[0-9A-Z]{16} |
AWS access keys |
fc-[a-f0-9]{32} |
Firecrawl API keys |
| Mnemonic phrases |
12/24 word seed phrases |
.env in git |
Uncommitted env files tracked |
| Hardcoded RPC URLs with API keys |
Alchemy, Infura, QuickNode |
Bearer [a-zA-Z0-9._-]+ |
Auth tokens in code |
| Server IPs in public files |
Infrastructure exposure |
| OAuth client secrets |
Google, GitHub OAuth |
| Telegram bot tokens |
Bot token patterns |
2. Wallet Safety (9 patterns)
| Check |
Risk Level |
| Unprotected transfer_tokens calls |
CRITICAL |
| Missing approval gate on swap operations |
CRITICAL |
| Auto-approve at trust level 0 |
HIGH |
| Wallet drain patterns (approve + transferFrom) |
CRITICAL |
| Missing amount limits on transactions |
HIGH |
| Contract deployment without gas estimation |
MEDIUM |
| Missing honeypot check before interaction |
HIGH |
| Unverified contract addresses hardcoded |
MEDIUM |
| Missing receipt/audit trail for transactions |
MEDIUM |
3. Agent Config Review (12 patterns)
| Check |
Risk Level |
--dangerously-skip-permissions without allowFrom |
CRITICAL |
| Missing requireMention in group configs |
HIGH |
| Overly broad tool access in agent definitions |
MEDIUM |
| MCP servers without rate limiting |
MEDIUM |
| Feature flags all TRUE (no safety gates) |
MEDIUM |
| Missing trust gate on outreach operations |
HIGH |
| Crons without maxRuns/expiresAt (infinite growth) |
HIGH |
| Event handlers with side effects (recursive risk) |
MEDIUM |
| Missing circuit breakers on mailbox |
HIGH |
| Unvalidated task DAG dependencies (deadlock risk) |
MEDIUM |
| server.js modifications without backup |
HIGH |
| Gmail OAuth without CC enforcement |
MEDIUM |
4. Contract Security (7 patterns)
| Check |
Risk Level |
| Deployer wallet used as contract owner |
CRITICAL |
| EIP-7702 delegated wallet as owner |
CRITICAL |
| Missing ownership transfer capability |
HIGH |
| Unverified contract source on block explorer |
MEDIUM |
| Missing reentrancy guards |
CRITICAL |
| Unchecked external calls |
HIGH |
| Missing event emission on state changes |
MEDIUM |
5. Infrastructure (5 patterns)
| Check |
Risk Level |
| Server IP in public content |
CRITICAL |
| SSH keys in repository |
CRITICAL |
| Docker socket exposed |
HIGH |
| Missing fail2ban or rate limiting |
MEDIUM |
| Unencrypted database connections |
MEDIUM |
Output Format
Terminal (default)
╔═══════════════════════════════════════╗
║ BUZZSHIELD SCAN REPORT — Grade: B+ ║
╚═══════════════════════════════════════╝
CRITICAL (0) ✅ None found
HIGH (2) ⚠️
→ Missing honeypot check in /api/routes/swap.js:42
→ Cron job without expiresAt in /api/services/cron/jobs/token-scan.js:18
MEDIUM (3) ℹ️
→ Unverified contract address hardcoded in /api/lib/contracts.js:7
→ Feature flag WALLET_GUARD=false (governance disabled)
→ Missing rate limit on /api/score endpoint
Files scanned: 142
Rules checked: 47
Time: 2.3s
JSON (CI/CD)
Exit code 2 on CRITICAL findings (build gate).
Markdown (HSaaS reports)
Full report with remediation steps for each finding.
Usage
Via Claude Code
/security-scan # Quick scan
/security-scan --deep # Include contract analysis
/security-scan --fix # Auto-fix safe issues
/security-scan --report markdown # Generate HSaaS report
Via CLI
npx @buzzbd/shield scan
npx @buzzbd/shield scan --fix
npx @buzzbd/shield scan --format json
How It Differs from AgentShield
| Feature |
AgentShield (ECC) |
BuzzShield (Buzz) |
| Focus |
Generic dev security |
Crypto agent security |
| Secret patterns |
14 generic |
14 generic + 14 crypto-specific |
| Wallet checks |
None |
9 wallet safety rules |
| Contract audit |
None |
7 smart contract patterns |
| Trust system |
None |
Trust gate verification |
| On-chain |
None |
Contract ownership checks |
| Cost |
Free |
Free (HSaaS report = $500) |
Architecture
BuzzShield runs entirely in Claude Code context — no external API calls.
It reads files via Bash/Grep/Glob tools and applies regex + heuristic rules.
Zero LLM cost for scanning. LLM used only for remediation suggestions.