Security audit

Teneo Agent SDK/CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly a Teneo agent-network CLI, but it gives remote agents and SDK payment flows too much automatic wallet authority for a normal install.

Install only if you are comfortable running a payment-capable blockchain CLI. Use a dedicated low-balance wallet, avoid putting real private keys in `.env` or `TENEO_PRIVATE_KEY`, prefer quote-and-confirm flows over automatic `command` execution, and do not run it where remote agent responses or command output may be logged with secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:407
Finding: Remote Backend Can Trigger Unrestricted Wallet Transactions
Content: View full analysis
{ const { taskId, tx, agentName, description } = data; console.error( JSON.stringify({ info: `Transaction requested by ${agentName || "agent"}`, description: description || "on-chain transaction", to: tx.to, value: tx.value, chainId: tx.chainId, }) ); try { const chain = getChain(tx.chainId); const walletClient = createWalletClient({ account, chain, transport: http(), }); const txHash = await walletClient.sendTransaction({ to: tx.to, value: tx.value ? BigInt(tx.value) : 0n, data: tx.data || undefined, chain, }); console.error( JSON.stringify({ info: "Transaction sent", txHash, chainId: tx.chainId }) ); await (sdk as any).sendTxResult(taskId, "confirmed", txHash); } catch (err: any) { console.error( JSON.stringify({ error: `Transaction failed: ${err.message}` }) ); await (sdk as any).s ...[truncated 2432 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:407
Finding: Agent Commands Automatically Approve Unbounded USDC Payments
Content: View full analysis
", "Internal agent ID (e.g. x-agent-enterprise-v2)") .argument("", "Command string: {trigger} {argument}") .option("--room ") .option("--timeout ", "Response timeout", "120000") .option("--chain ") .action(async (agent: string, cmd: string, opts: any) => { const room = resolveRoom(opts.room); await withSDK( async (sdk, attempt) => { const r = await (sdk as any).sendDirectCommand( { agent, command: cmd, room, ...(opts.chain ? { network: opts.chain } : {}), }, true ); if (!r || (!r.humanized && !r.raw)) { await sleep(4000); out({ status: "sent", note: "Command sent with payment. Response may arrive asynchronously.", }); } else { out({ humanized: r.humanized, raw: r.raw, metadata: r.metadata }); } }, { autoJoinRoom: room, payments: true, kickAgent: agent } ); }); ``` ### Technical Analysis Direct agent commands enable the ...[truncated 1551 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Automatic Installation Uses Mutable Dependency Versions for Wallet-Critical Code
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (25)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: teneo-protocol-cli version: 2.0.0 description: "Teneo Protocol CLI — discover and query 400+ AI agents on the Teneo Protocol network. Manage rooms, handle x402 USDC micropayments, and auto-generate encrypted wallets. Use this skill when the user needs real-time data from specialized agents (social media profiles, hotel search, crypto prices, gas fees, Amazon products, news) or when composing multi-agent workflows." homepage: https://teneo-protocol.ai metadata: {"teneo":{"backend":"wss://backend.developer.chatroom.teneo-protocol.ai/ws","sdk":"https://www.npmjs.com/package/@teneo-protocol/sdk","chains":["base:8453","peaq:3338"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly advertises auto-confirmation of paid actions and automatic signing of on-chain transaction requests from agents. This is dangerous because untrusted or malfunctioning remote agents can trigger spending or blockchain interactions without a per-transaction human approval step, especially in an agentic environment where commands may be chained automatically.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.
Then create the CLI script by writing the following content to ~/teneo-skill/teneo.ts:

typescript
#!/usr/bin/env npx tsx

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The skill encourages storing TENEO_PRIVATE_KEY in a .env file in the current working directory and auto-loads it. In many environments, working directories are shared, synced, committed to version control, or visible to other tooling, making this a common route for credential leakage.
Content: Scanner excerpt · SKILL.md (reported line 1370)May include surrounding context.

Authentication — signs the WebSocket handshake to prove identity on Teneo

Payment — signs x402 USDC transactions to pay agents

3. .env file (auto-loaded from current directory)

bash
echo "TENEO_PRIVATE_KEY=4a8b1c2d3e4f..." > .env

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The example immediately uses a command after placing a private key in .env, reinforcing a workflow where a high-value secret sits in a likely-to-be-exposed project file. Given the tool's payment and signing capabilities, compromise of that key can lead directly to asset theft and impersonation.
Content: Scanner excerpt · SKILL.md (reported line 1373)May include surrounding context.
3. .env file (auto-loaded from current directory)

bash
echo "TENEO_PRIVATE_KEY=4a8b1c2d3e4f..." > .env node ~/teneo-skill/teneo.ts command "hotel-finder" "search vienna" --room <roomId>

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation claims the key is 'NEVER logged, transmitted, or included in any API call,' but the code provides wallet-export-key, which outputs the private key to stdout as JSON. This contradiction can cause operators and upstream agents to trust the skill with secrets under false assumptions, increasing the chance of catastrophic wallet compromise.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1471)May include surrounding context.
md
---  ## Command Reference 24 commands across agent discovery, execution, room management, and wallet operations. All commands return JSON to stdout.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 97% confidence
Finding: Advertising 'auto-confirm' for free actions and automatic paid execution normalizes autonomous decision-making in a financial tool. In combination with remote agents and room-based workflows, this can allow spending decisions to occur without meaningful user review, which is unsafe for blockchain-integrated operations.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
1. **Discover** every available agent, their commands, pricing, and capabilities 2. **Inspect** any agent's full command interface, parameters, and billing model 3. **Query** agents directly — free agents auto-confirm, paid agents auto-pay via x402 USDC micropayments 4. **Manage rooms** — create private rooms, add/remove agents, control which agents you can query 5. **Handle payments** — automatic USDC payments on Base, Peaq, Avalanche, or X Layer 6. **Sign transactions** — handle on-chain transaction requests from agents (swaps, transfers) automatically

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The installation and first-run instructions normalize 'just run any command' behavior without a strong upfront warning that this creates a wallet and enables later paid behavior. In practice, this increases the chance that users or higher-level agents initialize sensitive payment state unintentionally and proceed without understanding the financial consequences.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: The shebang uses #!/usr/bin/env npx tsx, which causes execution through an unpinned tool-resolution path rather than a fixed, vendored runtime. In a skill that instructs users to auto-install packages and then run wallet/payment code, this increases supply-chain risk because a different npx/tsx resolution path or future package version could alter execution behavior.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The code path treats execution of almost any command as sufficient to auto-create a wallet, expanding the skill's side effects beyond simple read-only discovery. In an agent ecosystem, broad command availability combined with implicit credential generation and later payment capability is risky because callers may invoke the tool without understanding that security-sensitive state is being created.
Content: Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.
md
: `0x${PRIVATE_KEY}`; return privateKeyToAccount(key as `0x${string}`).address; } return fail("No wallet found. Run any command to auto-generate one."); } // ─── USDC Chain Config ───────────────────────────────────────────────────────

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: builder.withPayments({ autoApprove: true, quoteTimeout: 120000 }) programmatically enables automatic approval of payment quotes. This directly allows the SDK to spend funds without a per-action confirmation barrier, which is a significant security issue for a wallet-managing CLI connected to many third-party agents.
Content: Scanner excerpt · SKILL.md (reported line 414)May include surrounding context.
md
if (opts?.autoJoinRoom && !opts.autoJoinRoom.startsWith("private_")) builder.withAutoJoinPublicRooms([opts.autoJoinRoom]); if (opts?.payments) builder.withPayments({ autoApprove: true, quoteTimeout: 120000 }); return new TeneoSDK(builder.build()); }

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill includes a wallet-export-key command that decrypts and prints the private key, even though the primary purpose is agent discovery, room management, and payments. Any caller, wrapper agent, logging layer, or terminal history capture can expose the wallet secret, turning a local convenience feature into a credential-exfiltration path.
Content: No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: The documentation tells users to 'just run any command,' effectively granting broad operational access to functionality that can initialize wallet state and later authorize payments. In a multi-agent or automated setting, that lowers the barrier for unintended tool use and increases the risk of unauthorized financial actions.
Content: Scanner excerpt · SKILL.md (reported line 1364)May include surrounding context.
md
### 2. Encrypted wallet file (auto-generated) On first use, the CLI **auto-generates a new wallet** and stores it encrypted (AES-256-GCM) at `~/.teneo-wallet/wallet.json`. No setup needed — just run any command. The auto-generated key serves two purposes: - **Authentication** — signs the WebSocket handshake to prove identity on Teneo

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 88% confidence
Finding: Telling users to run any command to generate a wallet encourages indiscriminate invocation of a tool with security-sensitive side effects. This is more dangerous here because the skill also handles micropayments and transaction signing, so casual use can quickly transition into financial operations.
Content: Scanner excerpt · SKILL.md (reported line 1387)May include surrounding context.
md
### Funding the wallet 1. Run any command — a wallet is auto-generated and the address is printed 2. Send USDC to that address on Base, Peaq, Avalanche, or X Layer 3. The CLI detects the funder automatically and locks withdrawals to that address only

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The markdown lists commands like delete-room and remove-agent in a neutral reference style without warning that they change shared state and may disrupt ongoing workflows. For markdown files, omission of warnings around operations that affect system integrity or user workflow qualifies as a missing-warning issue.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 96% confidence
Finding: The documented payment flow states that paid requests are auto-signed and confirmed. This makes the system vulnerable to unintended or abusive spend triggers from remote agent interactions, especially when users may think they are only querying data services.
Content: Scanner excerpt · SKILL.md (reported line 1830)May include surrounding context.
md
1. You send a `command` to an agent 2. The SDK requests a price quote from the agent 3. If free (price=0), auto-confirms immediately 4. If paid, auto-signs an x402 USDC payment and confirms 5. Agent processes the request and returns data

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 95% confidence
Finding: The workflow encourages use of command with autoApprove for convenience, despite the tool managing real wallet funds. This preference for autonomous execution over user-mediated approval materially increases the risk of unauthorized or accidental payments.
Content: Scanner excerpt · SKILL.md (reported line 1846)May include surrounding context.
md
4. **Add agents to your room** — use `node ~/teneo-skill/teneo.ts add-agent <roomId> <agentId>` (remove one first if room is full) 5. **Verify the agent is reachable** — test with a cheap command first 6. **Send a command**: `node ~/teneo-skill/teneo.ts command "<agentId>" "<trigger> <argument>" --room <room>` — always use the internal agent ID 7. **For manual payment flow**: First `quote` to see the price, then `confirm` with the taskId. Note: `command` with autoApprove handles payment automatically. 8. **Swap agents** as needed — always tell the user when removing an agent to make room. If an agent is dead, find an alternative. 9. **Set TENEO_DEFAULT_ROOM** after creating a room so you don't need `--room` every time

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 1998)May include surrounding context.
md
| Agent | Commands | Description | |-------|:--------:|-------------| | [Amazon](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-amazon/SKILL.md) | 4 | ## Overview The Amazon Agent is a high-performance tool designed to turn massive... | | [Gas War Sniper](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-gas-war-sniper/SKILL.md) | 12 | Real-time multi-chain gas monitoring and spike detection. Monitors block-by-bloc... | | [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 1999)May include surrounding context.
md
| Agent | Commands | Description | |-------|:--------:|-------------| | [Amazon](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-amazon/SKILL.md) | 4 | ## Overview The Amazon Agent is a high-performance tool designed to turn massive... | | [Gas War Sniper](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-gas-war-sniper/SKILL.md) | 12 | Real-time multi-chain gas monitoring and spike detection. Monitors block-by-bloc... | | [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 2000)May include surrounding context.
md
|-------|:--------:|-------------| | [Amazon](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-amazon/SKILL.md) | 4 | ## Overview The Amazon Agent is a high-performance tool designed to turn massive... | | [Gas War Sniper](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-gas-war-sniper/SKILL.md) | 12 | Real-time multi-chain gas monitoring and spike detection. Monitors block-by-bloc... | | [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... | | [Messari BTC & ETH Tracker](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-messari-btc-eth-tracker/SKILL.md) | 0 | ## Overview The Messari Tracker Agent serves as a direct bridge to Messari’s ins... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 2001)May include surrounding context.
md
| [Amazon](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-amazon/SKILL.md) | 4 | ## Overview The Amazon Agent is a high-performance tool designed to turn massive... | | [Gas War Sniper](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-gas-war-sniper/SKILL.md) | 12 | Real-time multi-chain gas monitoring and spike detection. Monitors block-by-bloc... | | [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... | | [Messari BTC & ETH Tracker](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-messari-btc-eth-tracker/SKILL.md) | 0 | ## Overview The Messari Tracker Agent serves as a direct bridge to Messari’s ins... | | [X Platform Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-x-platform-agent/SKILL.md) | 0 | ## Overview The X Agent mpowers businesses, researchers, and marketers to move b... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 2002)May include surrounding context.
md
| [Gas War Sniper](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-gas-war-sniper/SKILL.md) | 12 | Real-time multi-chain gas monitoring and spike detection. Monitors block-by-bloc... | | [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... | | [Messari BTC & ETH Tracker](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-messari-btc-eth-tracker/SKILL.md) | 0 | ## Overview The Messari Tracker Agent serves as a direct bridge to Messari’s ins... | | [X Platform Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-x-platform-agent/SKILL.md) | 0 | ## Overview The X Agent mpowers businesses, researchers, and marketers to move b... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 2003)May include surrounding context.
md
| [Instagram Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-instagram-agent/SKILL.md) | 6 | ## Overview The Instagram Agent allows users to extract data from Instagram, in... | | [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... | | [Messari BTC & ETH Tracker](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-messari-btc-eth-tracker/SKILL.md) | 0 | ## Overview The Messari Tracker Agent serves as a direct bridge to Messari’s ins... | | [X Platform Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-x-platform-agent/SKILL.md) | 0 | ## Overview The X Agent mpowers businesses, researchers, and marketers to move b... |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 2004)May include surrounding context.
md
| [Tiktok](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-tiktok/SKILL.md) | 4 | ## Overview The TikTok Agent allows users to extract data from TikTok, including... | | [CoinMarketCap Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-coinmarketcap-agent/SKILL.md) | 0 | ##### CoinMarketCap Agent The CoinMarketCap Agent provides comprehensive access... | | [Messari BTC & ETH Tracker](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-messari-btc-eth-tracker/SKILL.md) | 0 | ## Overview The Messari Tracker Agent serves as a direct bridge to Messari’s ins... | | [X Platform Agent](https://github.com/TeneoProtocolAI/teneo-skills/blob/main/skills/teneo-agent-x-platform-agent/SKILL.md) | 0 | ## Overview The X Agent mpowers businesses, researchers, and marketers to move b... |

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

Missing User Warnings

Hidden Instructions

Credential Access

3. .env file (auto-loaded from current directory)

Credential Access

3. .env file (auto-loaded from current directory)

Intent-Code Divergence

Hidden Instructions

Autonomous Decision Making

Missing User Warnings

Rp1

Unrestricted Tool Access

Autonomous Decision Making

Context-Inappropriate Capability

Unrestricted Tool Access

Unrestricted Tool Access

Missing User Warnings

Autonomous Decision Making

Autonomous Decision Making

Skill Enumeration

Skill Enumeration

Skill Enumeration

Skill Enumeration

Skill Enumeration

Skill Enumeration

Skill Enumeration

Static analysis