buzzshield

name	buzzshield
description	> Use when this capability is needed.

BuzzShield — Crypto Agent Security Scanner

47 crypto-specific rules. Scans CLAUDE.md, .env, hooks, agents, skills. Built on lessons from building a $0/day LLM cost production agent.

When to Use

• Before deploying any crypto agent to production
• After adding new MCP servers or API keys
• Before hackathon submissions (catch leaks)
• As part of HSaaS security audit ($500 tier includes BuzzShield report)
• Periodic security hygiene check

What It Scans

1. Secret Detection (14 patterns)

Pattern	What It Catches
0x[a-fA-F0-9]{64}	Private keys (EVM)
[1-9A-HJ-NP-Za-km-z]{87,88}	Private keys (Solana)
sk-[a-zA-Z0-9]{48}	API keys (Anthropic, OpenAI)
ghp_[a-zA-Z0-9]{36}	GitHub personal access tokens
xoxb-[0-9]{11}-[0-9]{13}-[a-zA-Z0-9]{24}	Slack bot tokens
AKIA[0-9A-Z]{16}	AWS access keys
fc-[a-f0-9]{32}	Firecrawl API keys
Mnemonic phrases	12/24 word seed phrases
.env in git	Uncommitted env files tracked
Hardcoded RPC URLs with API keys	Alchemy, Infura, QuickNode
Bearer [a-zA-Z0-9._-]+	Auth tokens in code
Server IPs in public files	Infrastructure exposure
OAuth client secrets	Google, GitHub OAuth
Telegram bot tokens	Bot token patterns

2. Wallet Safety (9 patterns)

Check	Risk Level
Unprotected transfer_tokens calls	CRITICAL
Missing approval gate on swap operations	CRITICAL
Auto-approve at trust level 0	HIGH
Wallet drain patterns (approve + transferFrom)	CRITICAL
Missing amount limits on transactions	HIGH
Contract deployment without gas estimation	MEDIUM
Missing honeypot check before interaction	HIGH
Unverified contract addresses hardcoded	MEDIUM
Missing receipt/audit trail for transactions	MEDIUM

3. Agent Config Review (12 patterns)

Check	Risk Level
--dangerously-skip-permissions without allowFrom	CRITICAL
Missing requireMention in group configs	HIGH
Overly broad tool access in agent definitions	MEDIUM
MCP servers without rate limiting	MEDIUM
Feature flags all TRUE (no safety gates)	MEDIUM
Missing trust gate on outreach operations	HIGH
Crons without maxRuns/expiresAt (infinite growth)	HIGH
Event handlers with side effects (recursive risk)	MEDIUM
Missing circuit breakers on mailbox	HIGH
Unvalidated task DAG dependencies (deadlock risk)	MEDIUM
server.js modifications without backup	HIGH
Gmail OAuth without CC enforcement	MEDIUM

4. Contract Security (7 patterns)

Check	Risk Level
Deployer wallet used as contract owner	CRITICAL
EIP-7702 delegated wallet as owner	CRITICAL
Missing ownership transfer capability	HIGH
Unverified contract source on block explorer	MEDIUM
Missing reentrancy guards	CRITICAL
Unchecked external calls	HIGH
Missing event emission on state changes	MEDIUM

5. Infrastructure (5 patterns)

Check	Risk Level
Server IP in public content	CRITICAL
SSH keys in repository	CRITICAL
Docker socket exposed	HIGH
Missing fail2ban or rate limiting	MEDIUM
Unencrypted database connections	MEDIUM

Output Format

Terminal (default)

╔═══════════════════════════════════════╗
║  BUZZSHIELD SCAN REPORT — Grade: B+  ║
╚═══════════════════════════════════════╝

CRITICAL (0)  ✅ None found
HIGH     (2)  ⚠️
  → Missing honeypot check in /api/routes/swap.js:42
  → Cron job without expiresAt in /api/services/cron/jobs/token-scan.js:18
MEDIUM   (3)  ℹ️
  → Unverified contract address hardcoded in /api/lib/contracts.js:7
  → Feature flag WALLET_GUARD=false (governance disabled)
  → Missing rate limit on /api/score endpoint

Files scanned: 142
Rules checked: 47
Time: 2.3s

JSON (CI/CD)

Exit code 2 on CRITICAL findings (build gate).

Markdown (HSaaS reports)

Full report with remediation steps for each finding.

Usage

Via Claude Code

/security-scan                    # Quick scan
/security-scan --deep             # Include contract analysis
/security-scan --fix              # Auto-fix safe issues
/security-scan --report markdown  # Generate HSaaS report

Via CLI

npx @buzzbd/shield scan
npx @buzzbd/shield scan --fix
npx @buzzbd/shield scan --format json

How It Differs from AgentShield

Feature	AgentShield (ECC)	BuzzShield (Buzz)
Focus	Generic dev security	Crypto agent security
Secret patterns	14 generic	14 generic + 14 crypto-specific
Wallet checks	None	9 wallet safety rules
Contract audit	None	7 smart contract patterns
Trust system	None	Trust gate verification
On-chain	None	Contract ownership checks
Cost	Free	Free (HSaaS report = $500)

Architecture

BuzzShield runs entirely in Claude Code context — no external API calls. It reads files via Bash/Grep/Glob tools and applies regex + heuristic rules. Zero LLM cost for scanning. LLM used only for remediation suggestions.

---

Source: buzzbysolcex/buzz-bd-agent — distributed by TomeVault.