EM-A2A

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:22 AM UTC
• Version: 0.1.0

Overview

The skill is clearly for TRON payments, but it asks users to run an unpinned third-party MCP package with a wallet private key and can move funds without enough safety framing.

Review carefully before installing. Use testnet first, pin and review the MCP package version, avoid high-value or primary wallets, keep mainnet keys separate, and require explicit human approval before any payment, escrow release, or refund action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:75

Finding

Unpinned Third-Party MCP Package Executes with Access to a Wallet Private Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75–83
Vulnerability Type: Unpinned third-party dependency with access to sensitive credentials
Risk Level: High

Vulnerable Code:

json

{
  "mcpServers": {
    "a2a": {
      "command": "npx",
      "args": ["-y", "@poisonpyf/a2a-mcp"],
      "env": {
        "A2A_NETWORK": "shasta",
        "A2A_PRIVATE_KEY": "your-tron-private-key"
      }
    }
  }
}

Technical Analysis

The configuration uses npx -y to download and execute @poisonpyf/a2a-mcp without specifying an exact version or verifying an integrity digest. Consequently, the code executed can change after this Skill has been reviewed. The -y option also suppresses the normal installation confirmation.

The downloaded MCP server is explicitly provided A2A_PRIVATE_KEY through its process environment. It therefore has direct access to a credential capable of signing TRON transactions. The external package's implementation is not included in this project, so the audit cannot verify whether it securely handles the key, avoids logging it, restricts transaction signing, or prevents transmission to external systems.

This is a supply-chain weakness rather than proof that the named package is malicious. A compromised npm maintainer account, malicious future release, registry compromise, or dependency takeover could turn the documented setup into arbitrary third-party code execution with wallet access.

Attack Path

1. An attacker compromises the npm package, its maintainer account, or a transitive dependency and publishes a malicious release.
2. A user applies the documented configuration and starts the MCP server.
3. npx -y @poisonpyf/a2a-mcp resolves and executes the unpinned release without an interactive confirmation.
4. The malicious process reads A2A_PRIVATE_KEY from its environment.
5. It exfiltrates the private key, signs unauthorized transactions, or e ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the MCP package to an exact, reviewed version instead of resolving the latest release:

   json

   "args": ["-y", "@poisonpyf/a2a-mcp@0.1.0"]
   

   The version shown is illustrative and must be replaced with a release that has actually undergone security review.

2. Use a lockfile and verify package integrity, npm provenance, publisher identity, and release signatures where available. Re-review the package and its transitive dependencies before every upgrade.

3. Prefer installing the reviewed dependency during a controlled deployment phase rather than downloading executable code dynamically whenever the MCP server starts.

4. Do not expose a long-lived, high-value wallet private key directly to a third-party process. Use an isolated signer, hardware-backed key, delegated session key, or restricted wallet that enforces spending limits, destination allowlists, network restrictions, and explicit approval for transactions.

5. Use a dedicated wallet containing only the minimum funds required for the task. Keep testnet and mainnet credentials strictly separated and rotate the key immediately if compromise is suspected.

6. Run the MCP server inside a sandbox or container under a dedicated unprivileged account. Restrict filesystem access, outbound network connectivity, environment variables, and operating-system permissions to the minimum required.

7. Review or vendor the package source so its handling of private keys, logging, telemetry, transaction authorization, and network communication can be independently verified.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to configure an A2A_PRIVATE_KEY and exposes payment and escrow tools that can execute blockchain transactions, but it does not prominently warn that these actions may move real funds when pointed at mainnet. In an agentic context, this omission is dangerous because an operator may enable the skill assuming it is informational, while the agent can trigger irreversible on-chain transfers using the configured key.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.