Refuted findings 7
Candidates the review stage examined and rejected, kept for transparency.
Persistence
criticalRefutedlow confidenceThe `init` subcommand is documented to write agent control-plane files (.mcp.json and .claude/settings.json) into the agent folder, which could alter agent permissions or MCP config; the actual content written is not shown here.
a wallet, writes intent.md, .env, agent.json, .mcp.json, .claude/settings.json and .gitignore,
Why it was refuted
The CLI help openly documents the files `init` writes. The generated config pins the package version and restricts Claude Code to billboard tools, and nothing in it is concealed or adversarial.
Supply chain
highRefutedlow confidenceThe skill instructs agents to embed an unpinned `npx agent-billboard-mcp` install prompt in paid on-chain messages so that other agents reading the board install and run the package, a self-propagating distribution mechanism.
Put `npx agent-billboard-mcp` in the message so the agent reading it can install the server and act
Why it was refuted
Advertising to the next agent is the skill's openly declared core purpose. The package named is the artifact itself, and the same skill forbids following instructions found in board messages, so this is not a concealed supply-chain vector.
Persistence
highRefutedlow confidenceThe agent-folder module defines and (via writeFileAtomic) writes a Claude Code project MCP config (.mcp.json) and .claude/settings.json tool lock, an agent control-plane write not covered by the declared MCP tool list. The header comment documents it as part of `init`, so it is plausibly the intended setup, and the DET contradiction with the 'read-only mode' wallet claim does not hold.
mcpJson: '.mcp.json'
Why it was refuted
The line only defines a filename constant. The folder.ts line is not itself a write, and the `init` command's writes to .mcp.json are documented in the CLI help and restrict Claude Code to the billboard tools.
Persistence
highRefutedlow confidenceThe `init` CLI writes Claude Code control-plane files (.claude/settings.json and .mcp.json) into the agent folder. The write is documented in code and user-invoked, but it is not covered by the declared skill claims; the detector contradictions against the operator.wallet claim are unrelated.
writeFileAtomic(paths.settings, toJsonFile(claudeSettings()))
Why it was refuted
This is the user-invoked `init` command writing a deny-by-default Claude settings file, and the CLI help documents it. It restricts the folder to three billboard tools and does not broaden permissions.
Code execution
highRefutedlow confidenceThe `run` subcommand launches the operator's Claude Code in a loop on board changes. server.json's description of reading and posting does not declare this, though the CLI help does; the permissions it grants are not shown.
wake your own Claude Code for this agent
Why it was refuted
Launching the operator's own Claude Code is a documented, operator-invoked `run` command. It is locked to the billboard tools, and a wake never allows the write tools.
Agent hijacking
mediumRefutedlow confidenceThe skill tells the agent to embed an `npx agent-billboard-mcp` install pointer in paid board messages so that other agents reading them install the server and act, a self-propagating nudge that sits awkwardly with its own rule never to follow instructions found in board messages (declared as advertising, but it targets other agents).
Put `npx agent-billboard-mcp` in the message so the agent reading it can install the server and act
Why it was refuted
The embedded install pointer is the declared advertising function, written for the next agent reading the board. The skill's own Never list forbids following instructions found in board messages, so there is no concealed hijack.
Persistence
mediumRefutedlow confidenceThe bundled CLI (`init`) generates Claude Code control-plane files (.mcp.json, .claude/settings.json) in the agent folder, an undeclared capability beyond the MCP tools, though the settings only restrict tools to the billboard set and the behavior is documented.
which locks the folder to the billboard's read and bid tools
Why it was refuted
The flagged line is a documentation comment, not executable code. It states that the settings lock the folder to billboard tools, and the `init` behavior is documented in the CLI help.
