Security audit

Termix Agent Skills

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly coherent for Termix marketplace automation, but it handles wallet private keys, live blockchain transactions, background auto-replies, and bearer tokens in ways users should review carefully before installing.

Install only if you are comfortable giving this skill live marketplace and wallet-signing authority. Use a dedicated low-value wallet, avoid pasting production private keys into chat, review every transaction with --dry-run before broadcasting, do not pass absolute URLs to authenticated API helpers, and remember that autoreply sends buyer messages to the configured LLM provider and runs in the background until stopped.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (37)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The environment reference exposes and normalizes operational capabilities well beyond the manifest’s stated inspection/read/check scope, including authenticated state-changing REST calls, on-chain transaction execution, uploads, and campaign claim flows. This creates a dangerous scope mismatch: an agent or operator relying on the manifest may grant trust or approval under the assumption of read-only behavior while the skill documentation enables write and financial actions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This section documents direct wallet-key use, wallet signing, runtime token issuance, and live on-chain execution despite the skill metadata presenting a narrower operational profile. In skill ecosystems, undocumented signing and transaction capability materially increases risk because it can lead users or higher-level agents to expose private keys or authorize blockchain actions they did not expect this skill to perform.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: Documenting escrow, campaign vault, staking, approval, and settlement operations expands the practical authority of the skill into financial and dispute-sensitive workflows that exceed the declared inspection/read/check context. Even without executable code in this file, this guidance can steer an agent toward asset-moving or permission-changing actions under a misleadingly limited trust boundary.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The document directs users to perform agent registration, NFT minting, and staking operations, which are materially broader than the skill metadata's stated read/check/inspection scope. That capability expansion is dangerous because it can induce irreversible on-chain state changes and fund movement under a misleading trust boundary, increasing the chance that users authorize actions they did not expect this skill to facilitate.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This section includes an authenticated backend POST and subsequent instructions for on-chain mutations, despite the skill being framed primarily around reads, checks, and auto-reply workflows. In context, that mismatch is especially risky because users may rely on the manifest to judge safety, yet the document enables authenticated writes and blockchain transactions that can create assets and alter financial state.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The guide exposes a hardcoded bearer token directly in the documentation, which is a credential disclosure vulnerability. Anyone with access to the skill can reuse the token to call the backend metadata staging endpoint, potentially causing unauthorized API usage, abuse, quota exhaustion, or impersonation of legitimate workflow actions.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: The guide instructs use of a wallet private key to sign NFT minting and staking transactions, which introduces secret-handling and fund-movement capability far beyond the declared purpose of the skill. In this context, the danger is amplified because the workflow directly enables irreversible blockchain transactions and token approvals, so any misuse, user misunderstanding, or prompt-injection abuse could result in asset loss or unauthorized commitments.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The autoreply path sends inbox message contents to an external LLM endpoint using OPENROUTER_API_KEY or OPENAI-compatible APIs. That creates a real data exfiltration channel for potentially sensitive buyer/seller communications, and the manifest does not clearly warn that message contents will be transferred to a third-party model provider.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The script is explicitly designed as a generic authenticated REST client for broad provider workflows, including create/edit/publish/claim/submit operations, which exceeds the skill metadata's narrower read/inspection/autoreply/dispute-check framing. In an agent-skill context, this increases the chance an agent can be induced to perform unintended state-changing actions with privileged tokens.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code permits absolute URLs via `path.startsWith("http") ? path : ...`, and it attaches bearer tokens before issuing the request. This allows an attacker who can influence the path argument to exfiltrate session or runtime tokens to arbitrary external hosts, turning a generic API helper into an SSRF-style credential leakage primitive.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script is explicitly designed to sign arbitrary blockchain transaction intents using a local private key and broadcast them on-chain, but the skill metadata describes operational reads, inbox polling, and dispute/order inspection rather than asset-moving or contract-writing actions. This mismatch is dangerous because an agent or operator may load the skill expecting low-risk platform operations while actually gaining a hidden capability to spend funds, grant approvals, or interact with arbitrary contracts.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: This code accepts attacker-controlled JSON intents containing arbitrary destination addresses, calldata, value, and optional chain ID, then signs and submits them with WALLET_KEY. In the context of an agent skill, that is effectively a generic hot-wallet transaction executor: any compromised backend response, prompt-injected agent flow, or operator mistake can trigger token transfers, approvals, deposits, or interactions with malicious contracts resulting in direct asset loss.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The header states that signing and broadcasting transactions is the 'only on-chain building block the skill needs,' which reinforces that this capability is intentionally embedded despite the skill's declared non-transactional operational scope. That inconsistency increases the chance that reviewers or users misunderstand the trust boundary and underestimate the risk of loading the skill into an automated agent environment.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file implements generic blockchain JSON-RPC transaction broadcast capabilities, including fee calculation, nonce lookup, gas estimation, raw transaction submission, and receipt polling. That is materially outside the declared Termix operational scope, so it introduces an unjustified ability to move value or interact with external chains if invoked by other skill components, increasing the attack surface and the risk of unauthorized financial actions.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The code provides a reusable, chain-agnostic transaction primitive rather than a narrowly constrained business-specific integration. In the context of a skill described for Termix agent inspection, inbox polling, order reads, and dispute checks, this unjustified transaction capability is dangerous because it could be repurposed to broadcast signed transactions to a public blockchain without aligning to the stated purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This file bundles Ethereum cryptographic utilities including private-key address derivation, message signing, and raw EIP-1559 transaction signing that are unrelated to the declared Termix platform operations purpose. Hidden or undocumented signing capability materially expands what the skill can do with secrets and creates a high-risk path for unauthorized blockchain actions if an agent, operator, or prompt chain supplies a private key.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The exported functions `signMessage`, `signTransaction`, and `addressFromPrivateKey` enable direct use of raw private keys for blockchain operations, but this behavior is not described in the skill metadata. Undisclosed transaction-signing capability is dangerous because it can be invoked by other components or future prompts to authorize irreversible on-chain actions without operators expecting this skill to have that power.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to ask the user for a wallet private key through the chat workflow. Even if it claims the key is used locally and never echoed, collecting highly sensitive secrets via chat creates an unnecessary exfiltration risk, exposes users to prompt-level interception/logging, and normalizes unsafe secret-handling behavior.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The documentation explicitly instructs the operator to paste a wallet private key into chat, which is a highly sensitive credential handling anti-pattern. Even though the text says the key is used locally and not echoed back, entering a private key into an agent/chat workflow creates a substantial risk of disclosure through logs, model context retention, connector bugs, transcript storage, or accidental reuse by other tools.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation tells users to upload proof files and then submit a returned `publicUrl`, but it does not warn that uploaded evidence may be publicly accessible or contain sensitive information. In this provider-workflow context, proof artifacts can plausibly include screenshots, account metadata, or other identifying content, so omission of a visibility/privacy warning can lead to unintended disclosure.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The document instructs users to export a raw wallet private key into an environment variable and use it to sign and submit live blockchain transactions, but it does not prominently warn about key sensitivity, secure handling, shell history exposure, process inspection, or the recommendation to use a dedicated low-value wallet. In a skill that automates financial operations, normalizing direct private-key handling materially increases the chance of credential theft or accidental fund loss if users follow the guidance in unsafe environments.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The guide directs users to encrypt exchange API credentials and transmit them to a remote TEE-backed service, but it omits clear warnings about the account-risk implications, required API-key scoping, withdrawal-disable requirements, trust assumptions in the backend/TEE, and possible financial impact if the enclave, attestation flow, or surrounding service is compromised. Because this skill concerns automated trading infrastructure, sending live exchange credentials to a remote service is especially sensitive and should be treated as a high-risk action, even if encrypted in transit.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document explicitly requires a client wallet private key and instructs the operator to export it into an environment variable for a live on-chain transaction, but it does not include handling safeguards, storage guidance, or warnings about key exposure. In an agent-skill context, this is especially dangerous because users may paste production secrets into shared shells, logs, CI environments, or agent runtimes, leading to irreversible compromise of the client wallet and any assets or authority tied to it.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs the user to call ACPCore.setProvider() on-chain to assign a provider for a job, which is a state-changing operation with operational and financial consequences, but it does not prominently warn that this modifies live production state and may be irreversible or difficult to undo. In this skill context, the action directly affects job routing and execution authority, so an operator following the instructions casually could unintentionally alter a real job assignment.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documentation instructs users to pass a raw wallet private key via the `WALLET_KEY` environment variable when broadcasting an on-chain transaction, but it does not warn about secret-handling risks such as shell history leakage, process/environment exposure, CI log disclosure, or accidental reuse in shared terminals. In this skill's context, the credential directly controls a blockchain wallet and can authorize irreversible asset-affecting transactions, so poor secret-handling guidance materially increases the chance of wallet compromise or unauthorized spending.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/a2a-runtime.mjs:397

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/a2a-runtime.mjs:44

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/aacp-api.mjs:38

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: docs/client-create-job.md:385

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: docs/register-agent.md:63