Teneo Agent SDK/CLI

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:52 AM UTC
• Version: 1.0.21

Overview

This is a real Teneo wallet and agent CLI, but it can automatically spend crypto, sign remote-requested transactions, and print a private key, so it needs careful review before use.

Install only if you intend to let this skill manage a dedicated Teneo payment wallet. Use a fresh low-balance wallet, avoid TENEO_PRIVATE_KEY for any valuable account, prefer quote then confirm for paid actions, and treat wallet-export-key output as a live secret that should not appear in logs, chat transcripts, or shared terminals.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The `wallet-export-key` command decrypts and prints the private key in cleartext, which materially expands the skill's power beyond querying agents and handling payments. Once exposed to stdout or logs, the key can be copied, persisted, exfiltrated, or reused to drain all assets and impersonate the wallet on any supported chain.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The `wallet:tx_requested` handler automatically signs and submits arbitrary transactions provided by remote agents, not just bounded micropayments. A malicious or compromised agent/backend could request transfers, approvals, or arbitrary contract calls and the CLI would broadcast them without meaningful user review, enabling direct fund theft.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The security comment claims the generated key is used for local signing only, but later functionality allows decrypting and exporting that same key. This mismatch can mislead operators into trusting the wallet model more than warranted, increasing the chance they store real funds under false assumptions.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The markdown advertises automatic signing of agent-requested on-chain transactions without an explicit upfront requirement for user consent before execution. In the context of a skill intended for general agent discovery and querying, that omission makes dangerous signing behavior easy to trigger without informed operator approval.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The installation flow instructs operators to install and run a CLI that can auto-pay and auto-sign transactions before presenting a consolidated safety warning. That increases the likelihood a user will deploy it without understanding that first use may create a wallet and later spend funds or sign arbitrary on-chain actions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. **Discover** every available agent, their commands, pricing, and capabilities
2. **Inspect** any agent's full command interface, parameters, and billing model
3. **Query** agents directly — free agents auto-confirm, paid agents auto-pay via x402 USDC micropayments
4. **Manage rooms** — create private rooms, add/remove agents, control which agents you can query
5. **Handle payments** — automatic USDC payments on Base, Peaq, Avalanche, or X Layer
6. **Sign transactions** — handle on-chain transaction requests from agents (swaps, transfers) automatically

• Confidence: 92% confidence
• Finding: auto-confirm

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

if (opts?.autoJoinRoom && !opts.autoJoinRoom.startsWith("private_"))
    builder.withAutoJoinPublicRooms([opts.autoJoinRoom]);
  if (opts?.payments)
    builder.withPayments({ autoApprove: true, quoteTimeout: 120000 });
  return new TeneoSDK(builder.build());
}

• Confidence: 98% confidence
• Finding: autoApprove

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

1. You send a `command` to an agent
2. The SDK requests a price quote from the agent
3. If free (price=0), auto-confirms immediately
4. If paid, auto-signs an x402 USDC payment and confirms
5. Agent processes the request and returns data

• Confidence: 90% confidence
• Finding: auto-confirm

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

4. **Add agents to your room** — use `node ~/teneo-skill/teneo.ts add-agent <roomId> <agentId>` (remove one first if room is full)
5. **Verify the agent is reachable** — test with a cheap command first
6. **Send a command**: `node ~/teneo-skill/teneo.ts command "<agentId>" "<trigger> <argument>" --room <room>` — always use the internal agent ID
7. **For manual payment flow**: First `quote` to see the price, then `confirm` with the taskId. Note: `command` with autoApprove handles payment automatically.
8. **Swap agents** as needed — always tell the user when removing an agent to make room. If an agent is dead, find an alternative.
9. **Set TENEO_DEFAULT_ROOM** after creating a room so you don't need `--room` every time

• Confidence: 89% confidence
• Finding: autoApprove

VirusTotal

No VirusTotal findings

Static analysis

No suspicious patterns detected.