ClawHub
Back to skill

Security audit

Amazon - powered by Teneo Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly a paid Amazon data agent, but it asks users to install an unpinned SDK that handles wallet-backed automatic USDC payments without enough detail about transaction controls.

Before installing, treat this as a paid Web3 integration. Use a dedicated low-balance wallet, avoid exposing private keys to app configuration, pin and review the SDK version, and confirm how each USDC payment is authorized, limited, and revoked.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:68
Finding

Unpinned Third-Party SDK Is Entrusted with Wallet-Backed Automatic Payments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68–100
Vulnerability Type: Unpinned security-critical dependency with wallet and payment access
Risk Level: Medium

Vulnerable Code

markdown
Teneo Protocol connects you to specialized AI agents via WebSocket. Payments are handled automatically in USDC.

### Supported Networks

| Network | Chain ID | USDC Contract |
|---------|----------|---------------|
| Base | `eip155:8453` | `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` |
| Peaq | `eip155:3338` | `0xbbA60da06c2c5424f03f7434542280FCAd453d10` |
| Avalanche | `eip155:43114` | `0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E` |

### Prerequisites

- Node.js 18+
- An Ethereum wallet for signing transactions
- USDC on Base, Peaq, or Avalanche for payments

### Installation

```bash
npm install @teneo-protocol/sdk dotenv

Quick Start

See the Teneo Agent SDK for full setup instructions including wallet configuration.

typescript
import { TeneoSDK } from "@teneo-protocol/sdk";

const sdk = new TeneoSDK({
  wsUrl: "wss://backend.developer.chatroom.teneo-protocol.ai/ws",
  // See SDK docs for wallet setup

Technical Analysis

The Skill directs users to install @teneo-protocol/sdk without specifying an exact version or providing a lockfile or package-integrity value. It then assigns the dependency a security-critical role involving an Ethereum wallet, an external WebSocket connection, and automatic USDC payments.

The audited project contains only SKILL.md; the SDK implementation and its transitive dependencies are not included. Consequently, this audit cannot verify how private credentials are handled, what transaction restrictions are enforced, what data is transmitted, or whether each payment requires explicit authorization.

Installing a mutable package version means that future installations may retrieve ...[truncated 2174 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the SDK and all transitive dependencies to reviewed exact versions through a committed lockfile. Avoid floating ranges for payment-critical components.
  2. Verify package integrity during installation and CI builds. Use lockfile integrity metadata, a trusted internal registry or mirror, and reproducible builds.
  3. Audit the exact SDK release and its transitive dependency tree before deployment. Repeat the review whenever dependencies change.
  4. Isolate wallet signing from the third-party SDK. The SDK should submit transaction intents to a separate signer that enforces an explicit policy rather than receiving direct access to private keys.
  5. Require explicit user confirmation for every payment and display the network, asset contract, recipient, amount, fees, and total before signing.
  6. Enforce recipient allowlists, per-transaction limits, cumulative spending limits, short-lived sessions, and revocable token allowances. Use a dedicated low-balance wallet rather than a primary wallet.
  7. Prevent private keys or seed phrases from being exposed through environment variables or configuration accessible to the SDK. Prefer hardware wallets, managed signers, or isolated key-management services.
  8. Restrict outbound network access to documented destinations and disclose exactly what wallet, request, telemetry, and product-query data is transmitted.
  9. Add dependency scanning, provenance verification, publisher-change alerts, and automated review gates for SDK updates.
  10. Document whether automatic payment means automatic transaction construction or unattended signing. If unattended signing is supported, disable it by default and clearly explain its financial risk.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.