Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it sends wallet and signing secrets to a hosted service and understates when your content leaves your device.
Use public verification with non-sensitive inputs first. Do not submit a primary wallet key or reusable signing identity to the hosted tools. Prefer reviewed local signing, hash confidential content locally, and verify the network and transaction before approving writes. Pin and review optional packages before running them.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
claude mcp add veya --transport http https://mcp.veyanet.tech/mcp
**Codex**: `~/.codex/config.toml`
```toml
[mcp_servers.veya]
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
Add to ~/.codex/config.toml:
[mcp_servers.veya]
The anchoring workflow passes payerPrivateKey to a hosted MCP service, exposing the user's wallet signing credential to that service and potentially its logging infrastructure. A malicious or compromised service could use the key to sign unauthorized transactions and drain assets on networks where that key is used; HTTPS, wallet matching, and confirmation of the intended write do not prevent this. The explicit mainnet and funded-wallet context increases the danger, while the rule against repeating keys in replies does not address remote credential exposure.
The hosted setup presents payerPrivateKey as a routine tool argument without explaining that sending it gives the remote service the ability to sign transactions with that wallet. Unlike an application API key, a wallet private key generally grants control over all assets and permissions associated with the account, making the missing custody warning especially consequential.
Passing a wallet private key through agent tool arguments exposes it to the hosted MCP service and potentially to conversation histories, tool traces, or logging systems. A malicious operator or compromise of any system retaining the key could enable unauthorized transfers; HTTPS does not prevent access by the receiving service. This overlaps with SQP-2 but identifies the underlying secret-handling design rather than the missing warning.
The troubleshooting guidance normalizes passing a raw wallet private key as a tool argument without explaining that it grants control over the wallet. In this hosted MCP context, following that guidance could expose the key to the agent, remote service, or request logs, enabling unauthorized signing and theft of wallet assets. The explicit requirement for a funded wallet increases the potential harm, although the text does not establish malicious intent.
The matching criteria list “proofs” alongside VEYA-specific terms without requiring a VEYA or blockchain context. This could activate the skill for unrelated requests such as mathematical proofs, and no exclusion conditions are provided.
The installation command invokes an unpinned npm CLI and installs skill content without an immutable repository revision. A compromised or malicious future release could execute code with the installing user's permissions or introduce adversarial skill instructions; this is an installation supply-chain weakness, not specifically an unpinned MCP server version.
The example claims 'nothing sent' while passing the plaintext text argument to a hosted MCP service, which necessarily receives that argument. Even if the intended meaning is 'nothing written on-chain,' the wording can mislead users and agents into disclosing confidential material under the mistaken belief that hashing is local.
The installation command npx skills add veyanet/veya-skills does not pin the executable npm package or the downloaded skill revision, allowing installation behavior and agent instructions to change without review. A compromised package release or repository update could introduce code execution or malicious instructions; the wallet-linked API keys and on-chain operations described here increase the potential consequences. This is an installation supply-chain weakness, rather than direct evidence that the referenced MCP server is malicious or improperly versioned.
The workflow explicitly sends senderPrivateKeyHex to a hosted routing tool, exposing the private signing key beyond the sender's local trust boundary without warning or consent guidance. A compromised service or retained tool-call logs could expose the key and enable forged signatures under that identity; post-quantum cryptography does not protect a disclosed private key. Although this matches the documented tool interface rather than an apparent malicious diversion, its use for agent identity and secure routing makes the exposure consequential.
The workflow passes raw label and content to the hosted MCP server for hashing without explaining that the service receives the plaintext. Users seeking a cryptographic commitment may expect only a digest to leave their environment, so confidential material could be disclosed to the service and potentially its logs. Server-side hashing is legitimate functionality, but the proof-oriented context makes the missing privacy distinction consequential; the excerpt does not establish malicious collection or plaintext publication on-chain.
The command downloads and executes an unpinned npm package, while -y suppresses the installation confirmation. A compromised or malicious future release could execute with the operator's privileges; this is particularly dangerous for a service that may receive wallet private keys and API credentials.
“Any session” is an overly broad activation condition that does not distinguish sessions requiring VEYA connectivity from unrelated sessions. Although the surrounding document concerns VEYA service status, this instruction does not explicitly constrain when the checks should run.
No suspicious patterns detected.