Telegraph Protocol

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.1.0

Overview

This skill is coherent but needs Review because it can route broad requests to paid external AI services while using a wallet key, mutable remote tools, an unpinned npm server, and plaintext HTTP endpoints.

Review carefully before installing. Use only a dedicated burner wallet with minimal funds, avoid sending sensitive prompts or private media URLs, prefer pinned and audited MCP package versions, and do not use the documented plaintext endpoints for sensitive work unless the provider supplies authenticated HTTPS or equivalent protections.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:84

Finding

Remotely Mutable Tool Registry Enables Tool Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:84-86
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: High

Vulnerable Code Snippet:

markdown

### 4. Dynamic miner tools (auto-discovered)
On startup, the MCP server fetches the live integration registry and generates per-endpoint tools for every active miner. These update every 5 minutes without restart. The live set changes on-chain — treat the table below as a snapshot, not the source of truth:

Technical Analysis

The MCP server generates executable tool interfaces from an external registry and refreshes them every five minutes. Consequently, the effective tool surface can change after the Skill has been reviewed and installed.

The documentation does not specify a local allowlist, immutable schema pinning, registry signature verification, endpoint restrictions, or manual approval for newly discovered tools. A registry entry could therefore introduce a deceptive tool name, modify an existing endpoint schema, or redirect requests to an unintended provider.

This exceeds the minimum privileges required for remote inference. A fixed, reviewed set of inference operations would satisfy the declared functionality without continuously delegating tool definitions to mutable remote state.

Attack Path

1. An attacker compromises the live integration registry, its update mechanism, or an authorized registry publisher.
2. The attacker publishes a malicious or misleading miner endpoint definition.
3. Within five minutes, the MCP server refreshes the registry without requiring a restart or explicit user approval.
4. The server creates a trusted-looking dynamic tool from the attacker-controlled definition.
5. The Agent invokes that tool while processing an apparently legitimate request.
6. The malicious endpoint receives submitted prompts, URLs, media, or other tool parameters and can return manipulated results or trigger unintended p ...[truncated 525 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unrestricted discovery with a local allowlist of reviewed miner IDs, endpoint URLs, methods, and schemas.
• Pin each approved tool definition to a version or cryptographic digest.
• Require registry metadata to be cryptographically signed by explicitly trusted keys.
• Reject updates that change tool names, destinations, payment behavior, or input schemas without user approval.
• Display and log registry changes before activating them.
• Restrict dynamic tools to authenticated HTTPS endpoints on approved domains.
• Apply per-tool data-access and payment limits so a newly introduced tool cannot inherit all MCP server capabilities.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:132

Finding

Unpinned npm Package Executes with Access to a Wallet Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:132-145
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code Snippet:

json

{
  "mcpServers": {
    "telegraph": {
      "command": "npx",
      "args": ["-y", "telegraph-protocol-mcp"],
      "env": {
        "TELEGRAPH_NODE_URL": "http://13.237.89.59:7044",
        "TELEGRAPH_ENGINE_URL": "http://13.237.89.59:8080",
        "TELEGRAPH_DAEMON_URL": "http://13.237.89.59:8081",
        "TELEGRAPH_EVM_PRIVATE_KEY": "0xyour_burner_wallet_key"
      }
    }
  }
}

Technical Analysis

The recommended configuration uses npx -y telegraph-protocol-mcp without an exact package version or integrity digest. This permits npm to resolve and execute a package version that may differ from the version reviewed when the Skill was published. The -y option suppresses the normal installation confirmation.

The resulting process receives TELEGRAPH_EVM_PRIVATE_KEY directly through its environment. Any package code executed by npx, including install hooks and transitive dependencies, runs with the user's process privileges and can read that key.

Recommending a burner wallet reduces the potential financial loss but does not eliminate private-key theft, unauthorized payments, arbitrary local code execution, or access to other resources available to the MCP process.

Attack Path

1. An attacker compromises the npm publisher account, package release pipeline, package namespace, or a transitive dependency.
2. A malicious package version is published under the package name resolved by npx.
3. The user starts the configured MCP server.
4. npx -y downloads and executes the unpinned package without interactive confirmation.
5. Malicious package code reads TELEGRAPH_EVM_PRIVATE_KEY from the process environment.
6. The attacker exports the key, creates unauthorized signed payment authorizations, or executes ad ...[truncated 518 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the MCP package to an exact reviewed version rather than resolving the latest release.
• Verify the package with a lockfile and trusted integrity hash.
• Audit direct and transitive dependencies and disable unnecessary installation scripts.
• Install the reviewed package in advance instead of downloading code automatically at startup.
• Run the MCP server in a sandbox or container with a read-only filesystem, restricted network access, and no access to unrelated user files.
• Replace the raw private key with an external restricted signer or wallet service.
• Enforce per-transaction, per-session, and aggregate spending limits.
• Require explicit user confirmation for payments above a configured threshold.
• Continue using a dedicated wallet funded only with the minimum amount required.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:140

Finding

Sensitive Inference and Payment Traffic Is Routed over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:140-142
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code Snippet:

json

"TELEGRAPH_NODE_URL": "http://13.237.89.59:7044",
"TELEGRAPH_ENGINE_URL": "http://13.237.89.59:8080",
"TELEGRAPH_DAEMON_URL": "http://13.237.89.59:8081",

The Skill also demonstrates submission of user-controlled content to remote miners:

markdown

tg_engine_ask_subnet(subnet_id="18", method="GET", endpoint="/predict", payload={lat: 25.2, lon: 55.3, variable: "hourly"})
tg_engine_ask_subnet(subnet_id="34", method="POST", endpoint="/", payload={image_url: "https://..."})
tg_engine_ask_subnet(subnet_id="102", method="POST", endpoint="/chat", payload={model: "gpt-4o-mini", messages: [...]})

Technical Analysis

All three documented backend URLs use plaintext HTTP and a bare IP address. HTTP provides neither transport confidentiality nor authenticated server identity. An attacker able to observe or alter network traffic can inspect requests and responses or impersonate the configured backend.

The Skill's declared functionality necessarily requires external transmission for remote inference, but the transport should still provide confidentiality and endpoint authentication. The examples indicate that transmitted data can include prompts, chat messages, geographic coordinates, image URLs, routing metadata, inference results, and x402 payment-protocol messages.

The statement that the private key remains local does not mitigate this transport issue. Even if the raw key is never sent, an on-path attacker could observe sensitive content or attempt to manipulate responses and payment challenges exchanged over the connection.

Attack Path

1. A user invokes an inference tool with a prompt, media URL, location, or other sensitive input.
2. The MCP server sends the request to one of the configured plaintext HTTP endpoints.
3. A ...[truncated 1024 chars]

Remediation

View remediation

Remediation Suggestions

• Replace all plaintext HTTP URLs with HTTPS endpoints using valid certificates.
• Use authenticated domain names rather than bare IP addresses.
• Enforce certificate and hostname validation and prohibit plaintext fallback.
• Consider certificate or public-key pinning for payment-sensitive backend connections.
• Add application-layer signatures for registry records, inference responses, and payment challenges.
• Clearly disclose that prompts and media are sent to third-party miners.
• Require user consent before transmitting sensitive content.
• Redact credentials, personal information, private URLs, and unnecessary metadata before submission.
• Permit users to restrict requests to explicitly approved providers and destinations.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation description is broad enough to trigger on many common user requests such as weather, summaries, embeddings, image generation, and general LLM completions. Because this skill routes requests to an external paid network and can initiate micropayments via a configured wallet, over-activation can cause unintended external data sharing and unwanted charges even when the user did not explicitly ask to use Telegraph.

Content

No source excerpt is available for this finding.