Teller MCP – Borrow USDC & Altcoins

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:50 PM UTC
• Version: 0.1.6

Overview

The skill matches its Teller lending purpose, but it exposes high-impact borrow and repay transaction builders with insufficient validation and user-safety controls.

Review carefully before installing in any wallet-connected or automated trading environment. Treat the borrow and repay outputs as untrusted transaction proposals: decode them, verify contracts, spenders, amounts, chain IDs, and native values, and require explicit human approval before signing or submitting. Use only a trusted Teller API base URL and update or audit dependencies before deployment.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tellermcp-server/src/client.ts:63

Finding

Wallet and Financial Activity Data Is Transmitted in URL Query Strings

Content

View full analysis

{ return this.request('/borrow-tx', { walletAddress: params.walletAddress, collateralTokenAddress: params.collateralTokenAddress, chainId: params.chainId, poolAddress: params.poolAddress, collateralAmount: params.collateralAmount, principalAmount: params.principalAmount, loanDuration: params.loanDuration }); } getLoans(params: { walletAddress: string; chainId: number }): Promise { return this.request('/loans/get-all', { walletAddress: params.walletAddress, chainId: params.chainId }); } getRepayTransactions(params: { bidId: number; chainId: number; walletAddress: string; amount?: string }): Promise { return this.request('/loans/repay-tx', { bidId: params.bidId, chainId: params.chainId, walletAddress: params.walletAddress, amount: params.amount }); } private async request( path: string, query?: Record ): Promise { const url = new URL(path, this.baseUrl); if (query) { for (const [key, value] of Object.entries(query)) { if (value === undefined || value === null || value === '') continue; url.searchParams.set(key, String(value)); } } const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), this.timeoutMs); try { const response = await fetch(url, { signal: con ...[truncated 2326 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tellermcp-server/src/client.ts:108

Finding

Remote Transaction Calldata Is Returned Without Runtime or Integrity Validation

Content

View full analysis

( path: string, query?: Record ): Promise { const url = new URL(path, this.baseUrl); if (query) { for (const [key, value] of Object.entries(query)) { if (value === undefined || value === null || value === '') continue; url.searchParams.set(key, String(value)); } } const controller = new AbortController(); const timeout = setTimeout(() => controller.abort(), this.timeoutMs); try { const response = await fetch(url, { signal: controller.signal, headers: { 'accept': 'application/json' } }); if (!response.ok) { const body = await response.text(); throw new Error(`Request failed with ${response.status}: ${body}`); } return (await response.json()) as T; } catch (error) { if ((error as Error).name === 'AbortError') { throw new Error(`Request timed out after ${this.timeoutMs}ms`); } throw error; } finally { clearTimeout(timeout); } } ``` The transaction-builder handlers return this unvalidated response directly: ```ts async input => { const data = await client.getBorrowTransactions(input); return jsonResponse( `Prepared ${data.summary.totalTransactions} borrow transaction${data.summary.totalTransactions === 1 ? '' : 's'}.`, data ); } ``` ```ts async ({ bidId, chainId, walletAddress, amount }) => { const data = await client.getRepayTransactions({ bidId, chainId, walletAddress, amount }); const detail = data.summary.isFullRepayment ? 'full repayment' : 'partial repayment'; return json ...[truncated 3983 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

- `package.json` / `package-lock.json` – Node 20+ project metadata

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The lockfile pins @hono/node-server 1.19.9, and the listed advisories describe path traversal and authorization/middleware bypass issues in static file serving. Even though this file is only a dependency manifest, the finding is valid because the vulnerable package is present in the resolved dependency tree and this MCP server package is meant to be run as a network service, making server-side routing flaws relevant.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: express-rate-limit==8.2.1 — 1 advisory(ies): CVE-2026-30827 (express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting o)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

express-rate-limit 8.2.1 is present and the advisory describes bypass of per-client rate limiting via IPv4-mapped IPv6 handling. For an MCP backend exposed over HTTP, rate-limit bypass can materially weaken protections against brute force, scraping, or resource exhaustion, making this especially relevant in network-facing service code.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 86% confidence

Finding

fast-uri 3.1.0 is included via ajv and has multiple reported URI parsing and canonicalization issues, including host confusion and possible SSRF-related conditions. In an MCP server that may consume externally supplied URLs, schemas, or endpoint references, parser inconsistencies can become security-relevant, though actual exploitability depends on application behavior not visible in the lockfile.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.11.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

hono 4.11.9 is present and carries numerous advisories affecting cookie handling, routing, and related web framework behavior. Because this skill exposes an MCP backend server, framework-level request handling flaws can directly affect authentication, authorization, routing correctness, and header safety.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.0.1 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.0.1 is present via express-rate-limit and the cited issues include parsing inconsistencies and HTML-emitting XSS helpers. The rate-limit bypass ecosystem makes IP parsing correctness important in this server context, but the XSS-specific portion is less likely to matter unless the package's HTML rendering helpers are used elsewhere.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: path-to-regexp==8.3.0 — 2 advisory(ies): CVE-2026-4923 (path-to-regexp vulnerable to Regular Expression Denial of Service via multiple w); CVE-2026-4926 (path-to-regexp vulnerable to Denial of Service via sequential optional groups)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

path-to-regexp 8.3.0 is in the router stack and the advisories describe ReDoS/DoS conditions in route pattern processing. Since this package underpins HTTP routing, maliciously crafted requests can potentially trigger excessive CPU consumption and degrade availability of the MCP service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs users to install and run a bundled MCP server that makes outbound network requests and can read environment configuration, but it does not declare any explicit tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it easier for an agent or operator to invoke code with broader capabilities than reviewers can infer from the manifest alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README advertises tools that generate encoded on-chain borrow and repay transactions 'ready to submit' without clearly warning users that these actions can create debt, move funds, trigger approvals, and incur irreversible financial loss if misused. In an agent-integrated MCP context, this omission is more dangerous because downstream agents may treat the capability as routine infrastructure and surface transaction builders to users without sufficient friction or informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends wallet-related parameters to a remote API via HTTP query parameters, but the file contains no confirmation prompt, logging, comment, or docstring warning that user financial identifiers will be transmitted off-box. The same pattern recurs in other methods that submit wallet, loan, and repayment details, making the data-sharing behavior non-obvious from the code alone.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This TypeScript code issues multiple API requests through the Teller client using wallet addresses, chain IDs, pool addresses, bid IDs, and transaction parameters, but the tool definitions and handlers do not include any warning, confirmation, or explicit disclosure that this data is sent to an external service. For code files, network transmission of user or system data should have some visible disclosure unless the warning is provided elsewhere in markdown, which is not present in this file.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

body-parser 2.2.2 is present in the resolved tree, and the cited issue is a denial-of-service condition around invalid limit handling. In this MCP server context, request parsing is plausibly exposed to remote clients, so a parser-level DoS is relevant, though lower impact than auth bypass or traversal bugs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 70% confidence

Finding

esbuild 0.27.3 is indeed present, but here it is a devDependency used through tsx and not part of the normal production runtime. The advisory is limited to the development server on Windows, so this is a real dependency issue with constrained exploitability in the skill's intended server deployment context.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

qs 6.15.0 is present in the request parsing stack and the cited advisories are denial-of-service conditions and parsing edge cases. This is a legitimate issue for a network-facing service, but its impact is limited compared with auth bypass or traversal flaws and depends on whether attacker-controlled query/body structures are accepted at scale.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency uses a caret range, which permits automatic installation of newer compatible versions rather than an exact audited version. In an MCP server that may be installed and run by agents, this weakens supply-chain reproducibility and can expose deployments to unexpectedly introduced malicious or vulnerable upstream releases.

Content

Scanner excerpt · scripts/tellermcp-server/package.json (reported line 15)May include surrounding context.

json

"author": "",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.26.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The zod dependency is specified with a caret range, so different installs may resolve to different package versions over time. This creates a supply-chain risk and reduces reproducibility, which is especially relevant for an agent-facing backend that may be deployed automatically across environments.

Content

Scanner excerpt · scripts/tellermcp-server/package.json (reported line 16)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.26.0",
    "zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^25.2.3",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The devDependency @types/node is also unpinned, which can introduce non-deterministic builds and unexpected breakage or type-resolution changes between environments. While less directly exploitable than a runtime dependency, it still contributes to supply-chain unpredictability in the build pipeline.

Content

Scanner excerpt · scripts/tellermcp-server/package.json (reported line 19)May include surrounding context.

json

"zod": "^4.3.6"
  },
  "devDependencies": {
    "@types/node": "^25.2.3",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The tsx dev tool is unpinned and is executed directly through the start and dev scripts, meaning a compromised or breaking upstream release could affect local execution or development/runtime startup paths. Because this package is used to run TypeScript code rather than only provide types, the supply-chain risk is somewhat more consequential than passive dev-only metadata packages.

Content

Scanner excerpt · scripts/tellermcp-server/package.json (reported line 20)May include surrounding context.

json

},
  "devDependencies": {
    "@types/node": "^25.2.3",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The typescript compiler version is specified with a caret range, allowing drift in compiler behavior across builds. This primarily affects build integrity and reproducibility rather than direct runtime compromise, but it still expands the supply-chain attack surface.

Content

Scanner excerpt · scripts/tellermcp-server/package.json (reported line 21)May include surrounding context.

json

"devDependencies": {
    "@types/node": "^25.2.3",
    "tsx": "^4.21.0",
    "typescript": "^5.9.3"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The client allows the API destination to be overridden via the TELLER_API_BASE_URL environment variable without any validation or restriction. In an agent/backend deployment, a compromised or misconfigured environment could silently redirect sensitive wallet, borrowing, and repayment queries to an attacker-controlled endpoint, enabling data exfiltration or malicious transaction-building responses.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/tellermcp-server/src/client.ts:15