Security audit

Chainstream Defi

Security checks for vulnerabilities and agentic risk

Overview

This skill is upfront about doing real DeFi transactions, but it relies on mutable, unpinned external tools and installer instructions in wallet and payment flows.

Review this skill carefully before installing. Use only dedicated low-balance wallets, verify every transaction before signing, avoid importing valuable raw private keys, and prefer pinned, reviewed CLI or wallet tooling instead of unversioned `npx`, remote skill loading, or `curl | bash` setup paths.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: shared/authentication.md:203
Finding: Remote Installer Is Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: shared/authentication.md:197
Finding: Agent Behavior Is Delegated to Mutable External Skill Instructions
Content: View full analysis
" ``` ``` ### Technical Analysis The audited Skill instructs an agent to read or install instructions maintained outside the audited artifact. The remote Skill is referenced by a mutable URL or package identifier rather than an immutable commit, reviewed local copy, or verified content digest. Agent Skill documents are control-plane inputs: they can influence which commands an agent runs, what data it discloses, and whether it weakens existing safety constraints. If the external instructions change after this audit, the effective behavior of the audited Skill also changes even though none of its local fil ...[truncated 1773 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: shared/authentication.md:97
Finding: Unpinned Runtime CLI Is Entrusted With Raw Private Keys and Transaction Signing
Content: View full analysis
# Import Solana private key npx @chainstream-io/cli wallet set-raw --chain sol # Enter private key: # Verify addresses npx @chainstream-io/cli wallet address # EVM: 0xYourAddress # Solana: YourSolanaAddress # Set payment chain to match your funded wallet npx @chainstream-io/cli config set --key walletChain --value base # if paying with Base USDC npx @chainstream-io/cli config set --key walletChain --value sol # if paying with Solana USDC # All commands now use your imported key for auth + x402 payment npx @chainstream-io/cli token search --keyword PUMP --chain sol ``` The CLI will use your private key for both SIWX authentication and x402 payment. This works with any standard Base (EVM) or Solana private key. ``` The same unpinned CLI is also used to sign and broadcast transactions: ```bash npx @chainstream-io/cli wallet sign --chain sol --tx npx @chainstream-io/cli tx send --chain sol --signed-tx ``` ### Technical Analysis The project consistently invokes `npx @chainstream-io/cli` without an exact package version or integrity constraint. Depending on the local package state and `npx` behavior, this can resolve and execute a currently published package version at runtime. The repository contains no package lockfile, pinned integrity digest, or bundled C ...[truncated 2240 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (110)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://tempo.xyz/install | bash downloads a remote script and immediately executes it without review, pinning, or integrity verification. In an agent skill centered on wallet and payment setup, this is extremely dangerous because compromise of the remote host, CDN, or network path could yield arbitrary code execution and direct theft of keys, API tokens, or funds.
Content: Scanner excerpt · shared/authentication.md (reported line 207)May include surrounding context.
bash
# Set up Tempo Wallet (one-time — requires browser passkey auth) curl -fsSL https://tempo.xyz/install | bash tempo wallet login # View plans (no auth required)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash pipeline is a classic command-chaining pattern that turns a network fetch into immediate code execution. In this DeFi authentication context, the impact is amplified because the installed tool may later handle wallet login, API keys, and payment requests, so a malicious installer can establish persistent compromise before any safeguards apply.
Content: Scanner excerpt · shared/authentication.md (reported line 207)May include surrounding context.
bash
# Set up Tempo Wallet (one-time — requires browser passkey auth) curl -fsSL https://tempo.xyz/install | bash tempo wallet login # View plans (no auth required)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/x402-payment.md (reported line 256)May include surrounding context.
md
| USDC on **Base** | x402 | CLI auto-handles, or `@x402/fetch` | | USDC on **Solana** | x402 | CLI with `walletChain: "sol"` | | USDC.e on **Tempo** | MPP | `tempo request .../mpp/purchase?plan=<PLAN>` | | **No crypto wallet** | — | Get API Key from [Dashboard](https://app.chainstream.io) | If unsure, ask the user which chain their wallet is on. If they say "Tempo" or "Stripe" → MPP. If they say "Base", "Solana", or "USDC" → x402.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs use of npx @chainstream-io/cli without pinning an exact version, which allows the fetched package version to change over time. In a financial-execution skill that can create wallets, sign transactions, and broadcast irreversible on-chain actions, a compromised or malicious package update could directly lead to credential theft, wallet compromise, or unauthorized transaction execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This authentication flow also relies on an unpinned npx @chainstream-io/cli, meaning the very command used to create/configure wallets and set API keys can be replaced by whatever version is current at execution time. Because this skill handles real financial operations, exploitation could expose API keys, alter wallet setup behavior, or silently prepare malicious downstream transaction flows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README advertises swap, bridge, launchpad, and transaction broadcast capabilities without placing an immediate explicit warning that these operations move real funds and may be irreversible. In a financial execution skill, that omission increases the chance that users or downstream agents invoke destructive actions without appreciating the risk, especially when the skill is framed as a general capability catalog.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx @chainstream-io/cli login without pinning an exact package version. Because npx resolves the latest published package by default, a compromised maintainer account, dependency hijack, or malicious package update could cause arbitrary code execution on the user's machine at install/runtime, which is especially dangerous here because the CLI creates wallets and handles authentication for financial operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The usage examples include prompts such as swapping SOL and checking wallet PnL alongside informational queries, but they do not surround the wallet-affecting examples with warnings about real-fund movement, irreversible execution, slippage, address verification, or mandatory human confirmation. In an agent-integrated skill, natural-language examples are highly influential and may be copied directly into automated workflows, making the lack of safety framing more dangerous than in ordinary documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This example invokes npx @chainstream-io/cli without a pinned version, allowing execution of whatever package version is current at the time of use. In a DeFi execution skill, that materially raises risk because a malicious update could exfiltrate keys, alter destination addresses, or manipulate transaction construction before the user signs or broadcasts.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The unpinned npx command fetches and executes the latest package version at runtime, creating a supply-chain execution risk. Given this project's wallet and on-chain context, any compromise could directly influence financial decisions or transactions, not just local code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Using npx @chainstream-io/cli without version pinning exposes users to arbitrary upstream changes or a package compromise at execution time. Because this CLI can access wallet analytics and likely authenticated state, an attacker could abuse that trust boundary to collect sensitive data or steer users into malicious on-chain actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command example relies on an unpinned package fetched dynamically via npx, which is a known supply-chain risk. In a skill that supports routing swaps and other financial operations, a compromised package could tamper with route outputs or wallet-related parameters, potentially leading to fund loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: An unpinned npx GraphQL CLI example still executes remote package code and inherits the same supply-chain risk as the transaction examples. Even read-oriented commands matter here because the same CLI is positioned as an authenticated wallet-capable tool, so compromise can still impact secrets, session state, or subsequent transaction flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This final CLI example also pulls the latest package version implicitly via npx, creating an avoidable remote-code-execution and supply-chain trust issue. The danger is amplified by the project's DeFi scope: a malicious package could falsify analytics or prepare harmful follow-on actions that users may trust because they came from an official skill README.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill repeatedly instructs the agent to execute npx @chainstream-io/cli without pinning an exact package version or integrity hash. Because npx resolves and may fetch the latest published package at execution time, a compromised publisher account, malicious dependency update, or breaking release could cause the agent to run attacker-controlled code in a highly privileged financial-execution context.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
md
**Every command in this skill executes REAL, IRREVERSIBLE blockchain transactions.** - Transactions cannot be undone once confirmed on-chain. - The AI agent must **NEVER auto-execute** — explicit user confirmation is required every time. - Only use with funds the user is willing to trade. ## Integration Path (check FIRST)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This invocation uses unpinned npx @chainstream-io/cli in a workflow that checks auth state before enabling wallet-backed DeFi actions. An attacker controlling a newly resolved package version could subvert authentication flows, exfiltrate credentials, or mislead the agent before irreversible on-chain actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The login step relies on a dynamically resolved npx package, which is especially risky because it is part of wallet creation/authentication. If the package supply chain is compromised, the agent could execute malicious code that steals wallet material, session tokens, or manipulates subsequent transaction flows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Even the subscription verification step uses an unpinned npx command, allowing runtime substitution of code. While less directly sensitive than signing, compromise here could still misreport quota/subscription status and steer the agent into unsafe or fraudulent follow-on actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The skill tells users to run npx @chainstream-io/cli login if only an API key is present, but this package is not version-pinned. In a wallet-gated DeFi setting, dynamic package resolution increases supply-chain risk at the exact point where authentication and wallet setup occur.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The prerequisite authentication command is unpinned and may fetch whatever package version is current at runtime. In this skill, the CLI is not merely informational; it is a gateway to wallet access and later signing/broadcast, which amplifies the risk of malicious updates.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The wallet address command is unpinned, so the agent may execute unreviewed code from the registry at runtime. Although reading an address is less sensitive than signing, the same package often has access to wallet configuration and credentials, so compromise could still expose secrets or alter outputs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This unpinned wallet sign command is especially dangerous because it can directly produce signatures for blockchain transactions. If a malicious or compromised package version is resolved, it could sign different payloads, leak private material, or deceive the agent about what was signed, leading to irreversible loss of funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The raw private-key import path uses unpinned npx, which creates severe supply-chain exposure at a highly privileged moment. A compromised package could exfiltrate imported keys immediately, permanently compromising all funds controlled by that wallet.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Broadcasting a signed transaction through an unpinned package allows malicious code to substitute, duplicate, or manipulate the transaction submission path. In this financial skill, that can result in irreversible transfers, MEV-exposed rebroadcast behavior, or false success/failure reporting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.