ClawHub
Back to skill

Security audit

blacktea

Security checks for vulnerabilities and agentic risk

Overview

This payment-control skill is transparent about its goal, but it runs an unpinned remote npm MCP server with a real wallet private key, so users should review it carefully before use.

Install only if you are comfortable giving the MCP server a dedicated, low-balance wallet key. Pin and verify the package version where possible, avoid storing a valuable private key in shared agent config, start with BLACKTEA_RAIL=mock, and set a strict policy that requires human approval for any meaningful charge.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:45
Finding

Unpinned Third-Party Package Executes with Wallet Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-64
Vulnerability Type: Unpinned runtime dependency with access to sensitive signing credentials
Risk Level: High

Vulnerable Code

json
{
  "mcp": {
    "servers": {
      "blacktea": {
        "command": "npx",
        "args": ["-y", "@nmrtn/blacktea-mcp"],
        "env": {
          "EVM_PRIVATE_KEY": "0x...",
          "BLACKTEA_POLICY": "/path/to/policy.json"
        }
      }
    }
  }
}
bash
hermes mcp add blacktea \
  --command npx \
  --args -y @nmrtn/blacktea-mcp \
  --env EVM_PRIVATE_KEY=0x... BLACKTEA_POLICY=/path/to/policy.json

Technical Analysis

The Skill instructs users to execute @nmrtn/blacktea-mcp through npx -y without pinning an exact package version or verifying package integrity. This permits npm to retrieve and execute whichever package version currently satisfies the unversioned reference. The -y option suppresses the normal installation confirmation.

The resulting third-party process is explicitly given EVM_PRIVATE_KEY, a funded Base wallet's private key used to sign x402 USDC payments. The reviewed project contains only SKILL.md; it does not include the MCP server implementation, a lockfile, an integrity hash, or vendored source code. Consequently, the executable behavior, credential-handling claims, and policy enforcement cannot be verified from this artifact.

This is a supply-chain exposure rather than proof that the currently published package is malicious. Exploitation would require compromise or malicious modification of the package, its publisher account, or its transitive dependency chain.

Attack Path

  1. An attacker compromises the npm publisher account, the referenced package, or a transitive dependency.
  2. The attacker publishes a malicious version under the same unpinned package name.
  3. The Agent starts the MCP server using npx -y @nmrtn/blacktea-mcp.
  4. npx retrieves and executes the attacker-controlled pac ...[truncated 1089 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @nmrtn/blacktea-mcp to an exact, independently audited version instead of using an unversioned package reference.
  2. Install dependencies ahead of execution using a committed lockfile with verified registry integrity hashes; avoid runtime package downloads through npx.
  3. Vendor or otherwise retain the reviewed implementation so the code that runs is identical to the code that was audited.
  4. Verify package provenance and release signatures where available, and continuously monitor direct and transitive dependencies for compromise.
  5. Run the MCP server in a restricted sandbox with minimal filesystem, environment, process, and network access.
  6. Use a dedicated, low-value wallet funded only to the maximum acceptable loss.
  7. Prefer an external signer or hardware-backed signing service that enforces destination, asset, network, per-transaction, and cumulative spending limits independently of the npm process.
  8. Rotate the wallet key immediately if package integrity is ever in doubt or if it may have been exposed to an untrusted package version.
  9. Ensure payment policy enforcement occurs in a trusted component that does not share unrestricted access to the raw private key.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
Use blacktea whenever this agent might pay for something online: a paywalled
API, a premium data feed, any x402-enabled endpoint. blacktea sits between the
agent and its wallet and enforces a spending policy before any money moves. It
auto-approves small amounts, asks the human for larger ones, rejects what is
over the line, and writes an audit log of every payment.

## Setup (runs as a local MCP server)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
Use blacktea whenever this agent might pay for something online: a paywalled
API, a premium data feed, any x402-enabled endpoint. blacktea sits between the
agent and its wallet and enforces a spending policy before any money moves. It
auto-approves small amounts, asks the human for larger ones, rejects what is
over the line, and writes an audit log of every payment.

## Setup (runs as a local MCP server)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
Use blacktea whenever this agent might pay for something online: a paywalled
API, a premium data feed, any x402-enabled endpoint. blacktea sits between the
agent and its wallet and enforces a spending policy before any money moves. It
auto-approves small amounts, asks the human for larger ones, rejects what is
over the line, and writes an audit log of every payment.

## Setup (runs as a local MCP server)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
Use blacktea whenever this agent might pay for something online: a paywalled
API, a premium data feed, any x402-enabled endpoint. blacktea sits between the
agent and its wallet and enforces a spending policy before any money moves. It
auto-approves small amounts, asks the human for larger ones, rejects what is
over the line, and writes an audit log of every payment.

## Setup (runs as a local MCP server)

Static analysis

No suspicious patterns detected.