Security audit

Chia WalletConnect - Telegram Verification

Security checks across malware telemetry and agentic risk

Overview

This is a purpose-built Chia wallet verification skill with some privacy and hardening gaps, but I found no hidden exfiltration, destructive behavior, or purpose-mismatched authority.

Install only if you are comfortable operating a wallet-verification flow that links a Chia wallet address to a Telegram user. Before production use, add a clear privacy notice, remove sensitive console logs, replace the WalletConnect project ID, restrict CORS, authenticate or remove the status endpoint, rate-limit verification requests, and avoid long-term storage of signatures or public keys.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions while its documentation clearly requires environment variable access and outbound network communication to third-party services such as MintGarden, WalletConnect, Telegram-hosted web apps, and deployment platforms. This mismatch can undermine security review and least-privilege enforcement because operators may install the skill without understanding its real execution capabilities and data flows.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The function and comments claim signature verification via MintGarden API, but the implementation never performs cryptographic verification in this file. Instead it forwards signed data to the Telegram bot and immediately shows a success state, which can mislead users and downstream logic into treating an unverified submission as verified.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The inline comment says the code verifies signatures via MintGarden API, but the code only sends the payload to Telegram and displays a successful submission message. This documentation/behavior mismatch is security-relevant because users and maintainers may rely on nonexistent verification and make trust decisions on false assumptions.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README describes sending wallet verification data through Telegram Web App data flows and onward to the MintGarden API, but it does not clearly instruct implementers to disclose this to end users at the point of collection. Because wallet addresses, signed messages, and related metadata can be identifying and link a Telegram account to an on-chain identity, the lack of explicit privacy notice and consent increases privacy and correlation risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The app transmits wallet address, signed message, signature, public key, Telegram user ID, and timestamp to the Telegram bot without a clear user-facing disclosure or consent step. Even if operationally required, this is sensitive wallet/identity linkage data, and silent transmission increases privacy and trust risks in a Telegram mini-app context.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The code logs wallet address, WalletConnect URI, and public key material to the browser console. Console logs can be exposed to other scripts, browser extensions, shared devices, or debugging sessions, unnecessarily leaking connection artifacts and identity-related wallet data.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The UI prompts users to connect a wallet and sign a message but does not clearly warn that wallet identifiers and signature data will be shared and used for verification. In a Telegram Web App context, users may treat the flow as low-risk and sign without understanding what is being disclosed, increasing the chance of privacy loss or consent obtained without adequate notice.

Known Vulnerable Dependency: express==4.18.2 — 2 advisory(ies): CVE-2024-43796 (express vulnerable to XSS via response.redirect()); CVE-2024-29041 (Express.js Open Redirect in malformed URLs)

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: express==4.18.2

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.