ClawHub
Back to skill

Security audit

CoinMarketCap Agent - powered by Teneo Protocol

Security checks for vulnerabilities and agentic risk

Overview

This skill is disclosed as a paid crypto data agent, but it relies on an unpinned wallet-capable SDK and automatic USDC payments without enough in-artifact payment controls.

Install only if you are comfortable running the Teneo SDK with a dedicated low-balance wallet. Review the exact SDK version and wallet setup first, require explicit confirmation for every transaction, and avoid using a primary wallet or broad token allowances.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:51
Finding

Unpinned Wallet-Capable Dependency Enables Supply-Chain and Unauthorized Payment Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 51–84
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown
Teneo Protocol connects you to specialized AI agents via WebSocket. Payments are handled automatically in USDC.

### Supported Networks

| Network | Chain ID | USDC Contract |
|---------|----------|---------------|
| Base | `eip155:8453` | `0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913` |
| Peaq | `eip155:3338` | `0xbbA60da06c2c5424f03f7434542280FCAd453d10` |
| Avalanche | `eip155:43114` | `0xB97EF9Ef8734C71904D8002F8b6Bc66Dd9c48a6E` |

### Prerequisites

- Node.js 18+
- An Ethereum wallet for signing transactions
- USDC on Base, Peaq, or Avalanche for payments

### Installation

```bash
npm install @teneo-protocol/sdk dotenv

Quick Start

See the Teneo Agent SDK for full setup instructions including wallet configuration.

typescript
import { TeneoSDK } from "@teneo-protocol/sdk";

const sdk = new TeneoSDK({
  wsUrl: "wss://backend.developer.chatroom.teneo-protocol.ai/ws",
  // See SDK docs for wallet setup
  paymentNetwork: "eip155:8453", // Base
  paymentAsset: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", // USDC on Base
});

Technical Analysis

The installation command does not pin @teneo-protocol/sdk to a reviewed version and the project contains no lockfile, integrity hash, vendored source, or local implementation that would allow the installed code to be verified against the audited artifact. Package resolution can therefore select a later package release and its transitive dependencies.

The unresolved dependency is security-sensitive because the documented workflow gives it access to wallet-signing functionality, connects it to an external WebSocket endpoint, and states that USDC payments are handled automatically. These capabilities exceed ...[truncated 2464 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @teneo-protocol/sdk to an exact reviewed version rather than allowing npm to select the latest compatible release.
  2. Commit a lockfile and use reproducible installation such as npm ci; verify package integrity and review all transitive dependencies.
  3. Include or vendor the security-relevant SDK source in the auditable artifact, or publish a verifiable reference to the exact source commit and package digest.
  4. Require explicit, human-readable confirmation for every transaction. Display the network, token contract, recipient, exact amount, allowance changes, fees, and transaction calldata before signing.
  5. Do not enable automatic payments by default. Enforce configurable per-transaction, daily, and cumulative spending limits.
  6. Use a dedicated wallet with a minimal balance and no unrelated assets or broad token allowances. Never use a primary wallet.
  7. Document precisely how private keys are loaded, which data is transmitted over the WebSocket, how payment requests are authenticated, and whether any credentials or transaction metadata are retained.
  8. Authenticate and validate all server-originated payment requests locally. Do not rely solely on the remote service to determine transaction destinations or amounts.
  9. Run the SDK with least operating-system privilege and restrict filesystem, environment-variable, and network access where feasible.
  10. Provide a direct, payment-free CoinMarketCap API integration when the requested task only requires public market data.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.