Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `package.json` / `package-lock.json` – Node 20+ project metadata
Security audit
Teller MCP – Borrow USDC & Altcoins (no margin calls)
Security checks for vulnerabilities and agentic risk
Overview
This skill coherently exposes Teller lending API tools over MCP, but users should treat wallet lookups and generated transaction calldata as sensitive financial workflows.
Install only if you intend to let an agent query Teller with wallet-linked lending data and prepare borrow or repayment calldata. Review the target chain, token addresses, amounts, approvals, and contract targets before signing anything, and update or audit the npm dependency set before running it in a sensitive environment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)
Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The lockfile pins @hono/node-server 1.19.9, and the cited advisories describe path traversal and middleware/auth bypass issues in static file serving. In an MCP server context, HTTP exposure is plausible, so vulnerable routing/static serving components can undermine access controls if the package is used directly or indirectly by the server.
- Content
Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
express-rate-limit 8.2.1 is flagged for bypass via IPv4-mapped IPv6 addresses, which can let attackers evade per-client throttling. For an MCP server that may be internet- or agent-accessible, rate-limit bypass can materially weaken abuse protections and facilitate brute-force, scraping, or resource exhaustion.
- Content
Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
fast-uri 3.1.0 is flagged for multiple URI parsing and canonicalization issues, including host confusion and possible SSRF-relevant edge cases. Because MCP backends often fetch remote resources or validate user-supplied endpoints, flawed URI normalization can become security-significant if this library influences trust or allowlist decisions through transitive use.
- Content
Known Vulnerable Dependency: hono==4.11.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
hono 4.11.9 is flagged for numerous security issues affecting cookies, routing, and related HTTP behavior. Since @modelcontextprotocol/sdk depends on Hono components and this skill is intended to expose an MCP server, framework-level HTTP flaws can directly affect authentication, routing integrity, or request handling.
- Content
Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ip-address 10.0.1 is flagged for address parsing inconsistencies and an XSS issue in HTML-emitting methods. The XSS vector may be less relevant for a backend MCP server, but IP parsing ambiguities are more concerning because this package is used by express-rate-limit, where address normalization affects security decisions.
- Content
Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)
High
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
path-to-regexp 8.3.0 is flagged for ReDoS/DoS conditions triggered by crafted route patterns or matching behavior. In an HTTP server stack, route parsing and matching sit on the request path, so denial-of-service risk is credible if attackers can hit affected endpoints with pathological paths.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs users to install and run a bundled MCP server that makes outbound network requests and can consume environment variables, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it easier for an agent or operator to run the skill with broader capabilities than intended, especially since the skill is specifically designed to expose networked backend functionality.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README advertises generation of encoded on-chain borrow and repay transactions as 'ready to submit' without warning that these actions can create real financial obligations, trigger token approvals, and cause irreversible on-chain effects. In an agent-execution context, documentation that frames transaction builders as routine operational tools can encourage unsafe automation or blind signing, increasing the chance of unintended borrowing, repayment, or approval of token spend.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code sends wallet addresses, collateral details, pool addresses, bid IDs, and repayment amounts to remote API endpoints via query parameters. There is no confirmation prompt, user-facing log, or warning in this file indicating that user financial/account data will be transmitted off-system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The tool accepts a wallet address and sends it to an external Teller backend to calculate wallet-specific borrow terms, but this file provides no user-facing disclosure that wallet-linked data will be transmitted off-process/off-host. Wallet addresses are sensitive identifiers in crypto contexts because they enable profiling of holdings, activity, and credit or borrowing posture across services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This tool queries a wallet's active and historical loans from an external service using a user wallet address, yet there is no visible notice here that the address and associated request data leave the local agent environment. In DeFi, loan history can reveal financial behavior and create privacy risks, especially when linked to a persistent wallet identifier.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Repayment transaction building transmits wallet address, chain ID, bid/loan identifier, and optional repayment amount to an external service without any visible disclosure in this file. Those fields can expose a user's financial obligations and repayment intentions, and the external dependency also becomes a trust boundary for transaction construction.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The cheat sheet describes endpoints that accept wallet addresses and generate ready-to-submit on-chain transaction calldata, but it provides no caution that wallet queries expose user financial data and that generated transactions must be independently validated before signing. In an agent skill context, this omission can encourage unsafe automation where an agent fetches repayment or borrow transactions and passes them through without user review, increasing privacy and transaction-safety risk.
- Content
Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
body-parser 2.2.2 is flagged for a denial-of-service condition related to invalid limit handling. This is a real dependency risk, but in this lockfile-only context the impact is limited to request parsing instability rather than direct code execution.
- Content
Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)
Low
- Category
- Supply Chain
- Confidence
- 79% confidence
- Finding
qs 6.15.0 is flagged for denial-of-service issues in querystring parsing and serialization edge cases. This is a real but lower-severity dependency concern; in this MCP server context it mainly increases the risk of parser crashes or resource exhaustion from malformed query parameters.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The dependency uses a caret version range, which allows npm to install newer minor and patch releases than the one originally tested. If an upstream package is compromised or introduces a breaking or unsafe change, future installs may pull that version automatically, creating a supply-chain risk for anyone building or running this MCP server.
- Content
json "author": "", "license": "MIT", "dependencies": { "@modelcontextprotocol/sdk": "^1.26.0", "zod": "^4.3.6" }, "devDependencies": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The zod dependency is specified with a caret range, so installs are not fully reproducible and may resolve to a newer release than the one validated by the author. That increases supply-chain exposure because a malicious or vulnerable upstream release could be incorporated during install without any code change in this repository.
- Content
json "license": "MIT", "dependencies": { "@modelcontextprotocol/sdk": "^1.26.0", "zod": "^4.3.6" }, "devDependencies": { "@types/node": "^25.2.3",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
The dev dependency @types/node is also unpinned, which reduces build reproducibility and can unexpectedly change the development or CI environment over time. While this is less severe than a runtime dependency, compromised or incompatible dev tooling can still affect builds, type-driven code changes, or CI execution paths.
- Content
json "zod": "^4.3.6" }, "devDependencies": { "@types/node": "^25.2.3", "tsx": "^4.21.0", "typescript": "^5.9.3" }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The tsx dev dependency is unpinned and is directly used to start and watch the TypeScript server during development. Because it is an executable tool in the build/run chain, an unexpected upstream release or compromise could affect local execution or CI environments, making this a real but low-severity supply-chain concern.
- Content
json }, "devDependencies": { "@types/node": "^25.2.3", "tsx": "^4.21.0", "typescript": "^5.9.3" } }
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The typescript compiler version is specified with a caret, allowing future installs to pick up new releases automatically. Although primarily a build-time dependency, compiler changes or a compromised release can influence generated artifacts, CI behavior, or developer environments, so this remains a genuine supply-chain weakness.
- Content
json "devDependencies": { "@types/node": "^25.2.3", "tsx": "^4.21.0", "typescript": "^5.9.3" } }
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/tellermcp-server/src/client.ts:15