Security audit

Chainstream Graphql

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for ChainStream analytics, but it asks agents to run mutable external installers and unpinned CLI code in wallet, credential, and payment workflows.

Review before installing. Use only in an isolated environment, prefer a preinstalled and version-pinned ChainStream CLI, avoid `curl | bash`, do not import high-value private keys, and require explicit confirmation before any wallet creation, key storage, or paid plan purchase.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: shared/authentication.md:205
Finding: Remote Tempo Wallet Installer Is Executed Without Verification
Content: View full analysis
Remediation: View remediation
/install.sh ``` 4. Publish and verify a cryptographic checksum or signed release manifest: ```bash sha256sum -c tempo-installer.sh.sha256 ``` 5. Prefer signature verification using a documented release-signing key. 6. Allow the user to inspect the downloaded file before execution. 7. Require explicit user approval before installing software or opening a browser-based wallet enrollment flow. 8. Run installation with the lowest available privileges; never request elevated privileges unless strictly necessary and clearly disclosed. 9. Document the expected files, network destinations, and configuration changes made by the installer. 10. If a package manager is available, use a pinned package version with integrity metadata instead of a mutable installation URL. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:14
Finding: Security-Sensitive ChainStream CLI Is Executed Through Unpinned npx Dependencies
Content: View full analysis
# Option B: Create wallet for x402 auto-payment npx @chainstream-io/cli login # Option C: Check pricing first npx @chainstream-io/cli wallet pricing ``` It is also used for a real cryptocurrency payment: ```bash # Step 3: Check wallet balance to confirm USDC is on the right chain npx @chainstream-io/cli wallet balance --chain base --json # check Base npx @chainstream-io/cli wallet balance --chain sol --json # check Solana # Default payment chain is base. If USDC is on Solana: npx @chainstream-io/cli config set --key walletChain --value sol # Step 4: Purchase (real USDC payment via EIP-3009; not needed if trial plan is already ...[truncated 3155 chars]
Remediation: View remediation
graphql schema --summary ``` 2. Do not use version ranges or mutable tags such as `latest`. 3. Add a package manifest and lockfile containing integrity hashes, and execute with a lockfile-enforcing installation mode. 4. Publish verifiable package provenance and signed releases. 5. Review and lock transitive dependencies used by wallet and payment functionality. 6. Separate read-only GraphQL functionality from wallet import and payment-signing functionality so analytics does not automatically receive wallet privileges. 7. Run read-only queries in a restricted process without access to private-key files or unrelated environment variables. 8. Require explicit approval before: - Installing or updating the CLI. - Importing a private key. - Creating a wallet. - Signing a payment authorization. 9. Display and independently verify the payment network, token, amount, recipient, plan, and expiration immediately before signing. 10. Prefer hardware-backed or isolated wallet signing so the npm package never receives raw private-key material. 11. Document the expected package version and checksum in `SKILL.md`, `CLAUDE.md`, `README.project.md`, and all shared guides to prevent inconsistent execution paths. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (107)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL https://tempo.xyz/install | bash downloads and immediately executes a remote script without pinning, verification, or inspection. This creates a direct remote code execution path; if the server, CDN, DNS, TLS termination, or upstream content is compromised, attackers can run arbitrary commands on the host, steal credentials, or implant persistence.
Content: Scanner excerpt · shared/authentication.md (reported line 207)May include surrounding context.
bash
# Set up Tempo Wallet (one-time — requires browser passkey auth) curl -fsSL https://tempo.xyz/install | bash tempo wallet login # View plans (no auth required)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The pipe to bash is a dangerous command-chaining pattern because it eliminates any opportunity to inspect the fetched content before execution. In a wallet/payment setup context, compromise of this one-liner could immediately expose funds, API keys, session state, and the broader agent environment.
Content: Scanner excerpt · shared/authentication.md (reported line 207)May include surrounding context.
bash
# Set up Tempo Wallet (one-time — requires browser passkey auth) curl -fsSL https://tempo.xyz/install | bash tempo wallet login # View plans (no auth required)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · shared/x402-payment.md (reported line 256)May include surrounding context.
md
| USDC on **Base** | x402 | CLI auto-handles, or `@x402/fetch` | | USDC on **Solana** | x402 | CLI with `walletChain: "sol"` | | USDC.e on **Tempo** | MPP | `tempo request .../mpp/purchase?plan=<PLAN>` | | **No crypto wallet** | — | Get API Key from [Dashboard](https://app.chainstream.io) | If unsure, ask the user which chain their wallet is on. If they say "Tempo" or "Stripe" → MPP. If they say "Base", "Solana", or "USDC" → x402.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The invocation guidance says the skill should be used when the user asks about token info, security, price, holders, market trends, wallet PnL, holdings, or 'any read-only on-chain query via REST/MCP.' This is a wide natural-language trigger set without exclusions or negative examples, making activation boundaries unclear for borderline requests such as general market discussion versus an actual on-chain lookup.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The phrase 'User needs custom analytics' is open-ended, and terms like 'flexible GraphQL' and 'data not exposed by REST API' do not clearly define when this skill should be selected instead of the REST-based data skill. Without explicit routing constraints or negative examples, similar analytics requests could match multiple skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill instructs use of npx @chainstream-io/cli without pinning a specific version, which creates a supply-chain risk because execution may fetch the latest package at runtime. In an agent context, this is more dangerous than ordinary documentation because the instruction directly influences tool execution paths and could expose users to a compromised or breaking release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This line again directs runtime execution of an unpinned npm package, creating the same supply-chain exposure. Because the file presents this as a required operational step before queries, it increases the chance an agent or operator will execute unreviewed code from the registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx @chainstream-io/cli login without pinning a specific package version. Because npx resolves the latest published package by default, a compromised maintainer account, malicious new release, or supply-chain hijack could cause users to execute attacker-controlled code during installation or login. This is more concerning in this skill context because the CLI creates or imports wallets and handles authentication material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README includes a transaction example (swap 0.1 SOL for <token_address>) but does not prominently warn that blockchain transactions move real assets, may be irreversible, and can incur fees or slippage. In an AI-skill context, users may copy prompts verbatim or allow an agent to act on them, increasing the chance of accidental fund loss or unintended on-chain execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This example invokes npx @chainstream-io/cli without a pinned version, which exposes users to executing whatever package version is current at run time. In a blockchain-related CLI that queries data and may also manage credentials or wallet operations elsewhere in the project, an upstream package compromise could lead to code execution or credential theft.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The command example uses npx with an unpinned package reference, so users will fetch and run the latest package version from the registry. If the package or dependency chain is compromised, the README becomes an execution path for malicious code, which is especially risky in tooling associated with API keys and wallet authentication.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This unpinned npx example creates a supply-chain risk because it instructs users to execute a package whose contents may change over time without notice. In the context of a crypto data/DeFi ecosystem, that can increase the blast radius if a malicious release harvests secrets, alters query results, or pivots into wallet-related workflows.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README example relies on npx @chainstream-io/cli without version pinning, which means users execute the newest registry version rather than a vetted release. A compromised publication pipeline or malicious package update could therefore turn this benign example into arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This command example is another unpinned npx execution path, exposing users to mutable package contents from the npm registry. Since the surrounding project includes authentication, API-key usage, and wallet-related commands, a malicious package release could exfiltrate sensitive material or modify behavior invisibly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The GraphQL schema/query examples still use an unpinned npx package reference, carrying the same supply-chain risk as the other CLI examples. Even though these examples are read-oriented, the initial package execution itself is the danger, not the query semantics, and could enable local code execution if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill repeatedly instructs agents to execute npx @chainstream-io/cli without pinning an exact package version. Because npx resolves and may fetch the latest published package at runtime, a compromised publisher account, malicious update, or supply-chain hijack could cause arbitrary code execution in the agent environment before any GraphQL action occurs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command path tells the agent to invoke an unpinned npm package via npx, creating a runtime supply-chain trust dependency on whatever version is current at execution time. In an agent context that may handle API keys, wallets, and payments, that can expose secrets or enable arbitrary command execution if the package is malicious or compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The login step uses an unpinned CLI fetched at runtime, which is especially risky because this operation creates wallets and handles credentials. If an attacker controlled the resolved package version, they could intercept private keys, seed material, API keys, or alter payment behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs users to run login early, but does not present an upfront security warning that this creates blockchain wallets and persists credentials/API keys locally. That omission can lead users or autonomous agents to create durable sensitive assets on disk without informed consent, increasing exposure to host compromise, accidental reuse, and secret leakage.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill recommends checking subscription status with an unpinned npx package, preserving the same supply-chain execution risk as the other references. Even seemingly harmless status commands can execute arbitrary package lifecycle code or malicious CLI logic in the current environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This direct query example relies on unpinned npx package resolution, allowing a package update or takeover to change behavior invisibly. Because the command may later interact with paid APIs and locally stored API keys, exploitation could lead to credential theft, billing abuse, or remote code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The schema discovery command invokes an unversioned remote npm package via npx, which is a classic supply-chain risk. In this skill's context, the danger is elevated because users are encouraged to authenticate and store secrets locally before running these commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This typed schema lookup uses the same unpinned npx execution pattern, meaning the actual code executed depends on the latest package state rather than a reviewed artifact. That creates a preventable remote code execution and secret exposure path.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The full schema reference command again executes an unpinned npm package, exposing the environment to arbitrary upstream code changes. Since this skill supports payment flows and local credential persistence, exploitation could directly affect funds and API access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The API key configuration example depends on an unpinned package fetched at runtime. A malicious package could read the provided key, scrape local config files, or exfiltrate other environment secrets during the command.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.