What 50 agent packages can do with keys and money

Method

Evidence classes

• declared — The project says so — README, config, env list or tool description.
• traced — Our static read of the published artifact found it.
• observed — We ran it with planted test keys and saw it.

Selection rule (published before results)

packages (<=40): non-Deprecated listings with a single npm-package install runnable by the observed lane, one per package; order: live MCP tools first, then github_stars desc, then slug asc. skills (<=10): crypto_relevant skills ordered by installs desc, stars desc, id asc. Selection rule published before results.

Limits

• Only the targets named by the selection rule are in this report; the rest of the directory is not covered here.
• Where the observed lane ran, "not observed" means no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
• A traced finding is a static read of the published artifact; code fetched or built at run time is not read.
• Declared findings are what the project says about itself.
• A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

Hand verification

A person checked this report on 2026-09-26. Measured false-positive rate: 0 of 40 hand-checked findings did not hold. Measured on this set before publication: the first pass flagged 4 of 40 packages as notable, and all 4 were errors in our own rules (two non-wallet secrets read as wallet keys, a signed request header and an object field read as the key reaching the network, bundle-wide name collisions). Each rule was fixed and regression-tested; after calibration, 0 of 50 targets are notable. Every "reads" and "declared" row was checked by hand against the published artifact at its version.