ClawHub
Back to skill

Security audit

Theagora

Security checks for vulnerabilities and agentic risk

Overview

This commerce skill is purpose-aligned but needs Review because it can move real funds and auto-send buyer input to third-party providers with limited user-control guidance.

Install only if you are comfortable giving this MCP server a financially capable API key. Use a narrowly scoped, revocable key with low spending limits, pin or review the npm package version before running it, and require human approval before deposits, escrow purchases, exchange orders, or sending sensitive prompts/files to provider execution URLs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party Package Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–24 and 39–45
Vulnerability Type: Unpinned external npm dependency execution
Risk Level: Medium

Vulnerable Code

yaml
requires:
  env:
    - THEAGORA_API_KEY
  bins:
    - npx
emoji: "⚖️"
homepage: https://theagoralabs.ai
install:
  - kind: node
    package: "@theagora/mcp"
    bins: []
bash
# Install the MCP server
npx @theagora/mcp

# Set your API key
export THEAGORA_API_KEY="your_api_key_here"

Technical Analysis

The Skill directs users to resolve and execute @theagora/mcp from the npm registry without specifying an exact version. The reviewed project does not include the package source, a lockfile, an integrity hash, a signature, or other provenance metadata. The executable behavior can therefore change independently after this Skill is audited and cannot be verified from the supplied artifact.

Because npx downloads and runs package code, a compromised package release, maintainer account, registry response, or transitive dependency could result in arbitrary code execution under the invoking user's account. The required THEAGORA_API_KEY may also be available to the launched process.

The audit found no evidence that the current external package is malicious. The issue is the unsafe, non-reproducible dependency acquisition and execution mechanism.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or one of its transitive dependencies.
  2. The attacker publishes a malicious release under the same package name.
  3. A user follows the Skill's documented npx @theagora/mcp command.
  4. npx resolves and downloads the attacker-controlled package version.
  5. The malicious package executes with the user's local privileges.
  6. It may read process-accessible credentials such as THEAGORA_API_KEY, access files allowed to the user, contact attacker-controlled systems ...[truncated 716 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the MCP server to a specific audited version, for example:
    bash
    npx --yes @theagora/mcp@0.1.1
  2. Commit a lockfile that pins the complete transitive dependency graph.
  3. Publish and verify package integrity hashes, provenance attestations, or cryptographic signatures before execution.
  4. Include the MCP server source or a reproducibly built artifact in the audit scope.
  5. Generate and publish an SBOM for the package and its dependencies.
  6. Run the MCP server in a sandbox with minimal filesystem permissions, restricted network egress, and only the environment variables it strictly requires.
  7. Use a narrowly scoped, revocable API key with conservative transaction and daily spending limits.
  8. Require explicit user confirmation for deposits, purchases, escrow creation, and exchange orders.
  9. Establish dependency monitoring and promptly revoke affected releases and credentials if the supply chain is compromised.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill metadata instructs consumers to run an MCP server via npx without pinning an exact package version, which allows whatever version is current at execution time to be fetched and executed. Because this skill handles payments and escrow actions, a compromised or malicious package update could gain code execution in the agent environment and abuse credentials or trigger financial actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description presents escrow, purchasing, exchange trading, and automatic settlement as core features but does not clearly warn that tool use can commit real funds. In this context, omission is dangerous because users or higher-level agents may treat the skill as informational and unknowingly trigger purchases, orders, or deposits with financial consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The setup section explicitly tells users to run npx @theagora/mcp without a pinned version, causing live retrieval and execution of remote code. In a commerce skill with API keys and real-funds operations, this materially increases supply-chain risk because a package update or dependency compromise could immediately affect users at install or runtime.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

export THEAGORA_API_KEY="your_api_key_here"

text

Get an API key: `POST https://api.theagoralabs.ai/v1/agents/register` with `{"name": "your-agent", "email": "you@example.com"}`. One call, no approval, $50 free credits.

## Where Theagora Fits

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

export THEAGORA_API_KEY="your_api_key_here"

text

Get an API key: `POST https://api.theagoralabs.ai/v1/agents/register` with `{"name": "your-agent", "email": "you@example.com"}`. One call, no approval, $50 free credits.

## Where Theagora Fits

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

export THEAGORA_API_KEY="your_api_key_here"

text

Get an API key: `POST https://api.theagoralabs.ai/v1/agents/register` with `{"name": "your-agent", "email": "you@example.com"}`. One call, no approval, $50 free credits.

## Where Theagora Fits

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

export THEAGORA_API_KEY="your_api_key_here"

text

Get an API key: `POST https://api.theagoralabs.ai/v1/agents/register` with `{"name": "your-agent", "email": "you@example.com"}`. One call, no approval, $50 free credits.

## Where Theagora Fits

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The phrase 'no approval' in the registration flow promotes immediate account creation without an explicit human review step. In a financial marketplace context, this increases the chance that agents autonomously enroll, obtain credits, and proceed into money-moving workflows without adequate authorization or governance.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

export THEAGORA_API_KEY="your_api_key_here"

text

Get an API key: `POST https://api.theagoralabs.ai/v1/agents/register` with `{"name": "your-agent", "email": "you@example.com"}`. One call, no approval, $50 free credits.

## Where Theagora Fits

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The workflow states that create_escrow locks funds and may auto-execute the provider function immediately if an executionUrl exists. That combination means a single action can both commit money and transmit buyer input to a third party without a second confirmation step, which is particularly dangerous for autonomous agents and sensitive data.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
→ proofPassRate, settlementSuccessRate, disputes

3. create_escrow(functionId: "code-review", providerAgentId: "provider-id")
   → Funds lock. If function has executionUrl, auto-executes immediately.

4. check_escrow(escrowId: "abc123")
   → state: "RELEASED", result delivered, provider paid

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that buyer input is sent directly to provider endpoints during auto-execution, but it does not prominently warn about privacy, confidentiality, or third-party data exposure. This is especially risky in a marketplace for services like security audits or data analysis, where prompts and attachments may contain proprietary code, credentials, or sensitive business information.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
98% confidence
Finding

The key concepts section confirms that functions with executionUrl execute automatically when purchased and that buyer input is forwarded as the POST body. In this skill's context, autonomous execution magnifies both financial and privacy risk because a purchase can immediately trigger external processing by untrusted marketplace participants.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md
- **Escrow states:** HELD → RELEASED (provider paid) or REFUNDED (buyer refunded) or DISPUTED
- **4-tier verification:** Hash integrity, schema validation, canary correctness, content safety — all parallel, sub-100ms
- **Auto-execute:** Functions with `executionUrl` execute automatically when purchased. Buyer input goes directly to your endpoint as POST body. Theagora metadata in `X-Theagora-*` headers.
- **Zero gas fees:** Internal ledger. Top up with USDC or Stripe, trade at cost, withdraw USDC.
- **x402 (Base mainnet):** On-chain USDC for protocol-level settlement without a Theagora wallet.
- **Reputation:** Per-function metrics from actual transaction outcomes, not reviews.

Static analysis

No suspicious patterns detected.