TruthSea Verifier

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 PM UTC
• Version: 2.5.1

Overview

This skill is coherent for blockchain verification, but it asks users to give an agent-accessible wallet private key while running an unpinned external MCP package.

Install only if you are comfortable with an external npm MCP server handling blockchain actions. Do not use a main wallet; use a dedicated low-value testnet/hot wallet, avoid committing MCP config with secrets, and prefer a pinned or separately audited truthsea-mcp-server version before enabling write operations.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: install.sh:8

Finding

Unpinned Third-Party MCP Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: install.sh, line 8
Additional Location: mcp-config.json, lines 4-5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code

install.sh:

bash

# Install the MCP server globally
npm install -g truthsea-mcp-server

mcp-config.json:

json

"command": "npx",
"args": ["-y", "truthsea-mcp-server"],

Technical Analysis

The installer downloads truthsea-mcp-server without specifying an exact version or verifying an integrity hash. The runtime configuration independently invokes the same unpinned package through npx -y, which permits automatic retrieval and execution without interactive confirmation.

Consequently, the code reviewed during one installation is not guaranteed to be the code executed later. A newly published, compromised, or otherwise unsafe npm release could be selected automatically. The global installation also does not ensure that npx will execute the same previously reviewed package version.

The effective MCP server implementation is not included in the audited project. Therefore, this audit cannot verify the documentation's assertion that the server never transmits or logs DEPLOYER_PRIVATE_KEY. When configured, that private key is supplied to the external MCP process through its environment and can be read by any code executing inside that process.

Attack Path

1. An attacker compromises the npm account, package publication process, or another relevant component of the truthsea-mcp-server supply chain.
2. The attacker publishes a malicious version under the expected package name.
3. A user runs install.sh, causing npm to resolve and install the unpinned malicious release, or starts the MCP integration, causing npx -y to retrieve and execute it.
4. The malicious package executes with the privileges of the user running the agent.
5. If configured, the package reads `DEPLOYER_ ...[truncated 849 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a reviewed exact package version in both installation and execution paths, for example:

   bash

   npm install --global --save-exact truthsea-mcp-server@2.5.0
   

2. Remove the unpinned npx -y runtime invocation. Install the dependency locally and invoke its verified local executable directly.

3. Commit a lockfile containing resolved versions and integrity metadata, and use npm ci for reproducible installation.

4. Verify the package provenance and registry integrity before installation. Consider requiring npm provenance attestations and approving package hashes in deployment policy.

5. Vendor or separately audit the MCP server implementation because it receives sensitive signing credentials and performs blockchain operations.

6. Supply the private key only at runtime through a secret manager rather than placing it directly in persistent configuration.

7. Continue using a dedicated, minimally funded wallet, and additionally restrict token approvals, contract permissions, and available balances.

8. Run the MCP server in a sandbox with limited filesystem and network access so dependency compromise does not grant unrestricted access to the host account.

9. Establish an explicit dependency-update process in which new versions are reviewed, tested, and approved before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly instructs users to set a DEPLOYER_PRIVATE_KEY in MCP configuration without any warning about secret handling, least-privilege, or the financial risk of exposing a blockchain private key. In the context of an agent skill that may be installed by users unfamiliar with secure key management, this increases the chance that sensitive credentials are copied into plaintext configs, logs, screenshots, or shared repositories, enabling wallet compromise and unauthorized on-chain actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest declares a write-capable secret in primaryEnv/requires.env (DEPLOYER_PRIVATE_KEY) while the skill advertises blockchain actions such as claiming bounties, disputes, staking collateral, and flagging/slashing operations. Although the description mentions read-only mode by default, the manifest does not prominently warn that supplying this key enables irreversible on-chain transactions and exposes a high-value credential to the skill runtime, increasing the risk of wallet misuse or unintended signing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The installer performs a global npm installation, which modifies the host environment and may require elevated privileges, but it does so without clearly warning the user about the scope of the change. This is not inherently malicious, but it can surprise users, affect other projects or users on the system, and increase risk if the package or its dependency chain is later found to be unsafe.

Content

No source excerpt is available for this finding.