Cardano Staking

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:18 PM UTC
• Version: 1.0.0

Overview

This skill is for read-only Cardano staking checks, but it asks users to provide a wallet seed phrase to an external MCP server.

Review this carefully before installing. Do not provide a real wallet seed phrase to this skill unless you fully trust the external MCP package and understand that a seed phrase can grant control over wallet funds. A safer design would use a public stake address, reward address, or another read-only identifier and pin the MCP package to a reviewed version.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:10
• Finding: Wallet Seed Phrase Required for a Read-Only Staking Query## Vulnerability Details **File Location**: `SKILL.md`, lines 10–14 **Vulnerability Type**: Excessive access to wallet recovery credentials **Risk Level**: High ```yaml requires: env: [SEED_PHRASE] install: - kind: node package: "@indigoprotocol/cardano-mcp" ``` ### Technical Analysis The skill requires a complete wallet seed phrase even though its documented purpose is limited to retrieving the delegated stake pool and available staking rewards. These are read-only operations that can ordinarily be performed using a public stake address, reward address, or another read-only wallet identifier. A seed phrase is not merely an API credential: it is sufficient to derive the wallet's private keys and authorize transactions. Supplying it to the external MCP server process therefore grants substantially more privilege than the documented task requires and violates the principle of least privilege. The implementation of `@indigoprotocol/cardano-mcp` is not included in the audited project. Consequently, this project does not provide evidence that the seed phrase is isolated, never logged, never transmitted, securely erased, or otherwise protected by the server. ### Attack Path 1. A user installs and runs the declared `@indigoprotocol/cardano-mcp` server. 2. The user exposes the wallet recovery phrase through the `SEED_PHRASE` environment variable. 3. The external MCP process inherits or reads that environment variable. 4. If the dependency, one of its transitive dependencies, or its runtime environment is compromised, the seed phrase can be copied, logged, or transmitted. 5. An attacker can use the recovered phrase to derive wallet private keys. 6. The attacker can then sign unauthorized transactions and transfer assets controlled by the wallet. ### Impact Assessment Exposure of the seed phrase can provide control over every wallet key derived from that phrase, rather than access being limited to staking info ...[truncated 300 chars]
• Remediation: ## Remediation Suggestions - Remove `SEED_PHRASE` from the skill's required environment variables. - Use a public stake address, reward address, or another read-only wallet identifier for delegation and reward queries. - If a future operation requires signing, use a hardware wallet or an isolated signing interface that requests explicit approval for each transaction without revealing the recovery phrase. - Separate read-only query functionality from transaction-signing functionality and assign each component only the minimum required permissions. - Document which wallet data the MCP server receives, where it is processed, and whether any network service receives it. - Add tests or policy checks that prevent read-only skills from declaring recovery phrases or private keys as required inputs. - Advise existing users who supplied their phrase to an untrusted or unverifiable implementation to assess possible exposure and migrate funds to a newly generated wallet if compromise is suspected.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Executable Third-Party MCP Dependency## Vulnerability Details **File Location**: `SKILL.md`, lines 13–14 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ```yaml install: - kind: node package: "@indigoprotocol/cardano-mcp" ``` ### Technical Analysis The installation metadata identifies `@indigoprotocol/cardano-mcp` without an exact version or integrity digest. Dependency resolution may therefore select a release that differs from the version originally reviewed or expected by the skill author. The dependency's source code is not included in this project, so its package lifecycle scripts, transitive dependencies, network behavior, and handling of `SEED_PHRASE` cannot be verified from the audited artifact. Because the package executes while a high-value wallet recovery secret is available, a compromised registry account, malicious future release, or compromised transitive dependency would have a particularly severe security context. This finding does not establish that the named package is currently malicious. The vulnerability is the absence of reproducible version and integrity controls around executable third-party code that receives access to sensitive wallet material. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or a dependency incorporated into a later package release. 2. The attacker publishes altered code under a version accepted by the unpinned package declaration. 3. A subsequent skill installation resolves and installs the altered release. 4. The package executes during installation or while operating as the MCP server. 5. The altered code accesses the `SEED_PHRASE` environment variable available to the server. 6. The code transmits the phrase or uses it to derive keys and authorize unauthorized wallet transactions. ### Impact Assessment Successful supply-chain exploitation could permit arbitrary code execution with the permissions of the proces ...[truncated 410 chars]
• Remediation: ## Remediation Suggestions - Pin `@indigoprotocol/cardano-mcp` to an exact, reviewed version rather than allowing unconstrained resolution. - Record and verify the package integrity digest through a committed lockfile or equivalent trusted installation mechanism. - Review and link the precise dependency source and revision used by the skill. - Audit package lifecycle scripts and transitive dependencies before deployment. - Disable installation scripts where they are unnecessary and supported by the deployment environment. - Run the MCP server in a sandbox with minimal filesystem, environment, and network access. - Do not expose a wallet seed phrase to the dependency; use a public read-only identifier as described in the preceding finding. - Establish an update process that requires security review before changing the pinned package version or integrity value.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill manifest declares a requirement for `SEED_PHRASE`, which is highly sensitive wallet material, but the skill description and user-facing text only mention checking staking delegation and rewards and do not explain why full seed access is needed or how it will be handled. In this context, requesting a wallet seed for a read-oriented staking query creates unnecessary exposure of funds if the secret is mishandled, logged, or accessed by compromised tooling.

Static analysis

No suspicious patterns detected.