Is hunterdrop22/tyt safe?
https://github.com/openclaw/skills/tree/main/skills/hunterdrop22/tyt
The hunterdrop22/tyt skill is a documentation page for the Teneo Protocol SDK, enabling LLM agents to interact with a blockchain-based AI agent marketplace using Ethereum private keys and the x402 cryptocurrency micropayment protocol. The skill directory is clean — documentation only, no executable code, no install hooks, no prompt injection — and the clone process was entirely normal. However, the skill's intended functionality creates material security concerns: agents following it will transmit user Ethereum private keys to a third-party server, make autonomous real-money cryptocurrency micropayments without per-transaction consent, and directly render unfiltered responses from external Teneo-platform agents that could carry secondary prompt injection payloads. This skill is only appropriate in explicitly developer-controlled contexts where users have been fully informed of the financial and data-sharing implications.
Category Scores
Findings (9)
HIGH Ethereum Private Key Transmitted to Third-Party WebSocket Server -30 ▶
The Teneo SDK authenticates to wss://backend.developer.chatroom.teneo-protocol.ai/ws using a user-supplied Ethereum private key to sign wallet challenges. An agent following this skill will transmit authentication material tied to a user's crypto wallet to a server entirely outside the user's control, establishing a persistent authorized session under the user's wallet identity on Teneo's infrastructure.
HIGH Autonomous Cryptocurrency Micropayments Without Per-Transaction User Consent -30 ▶
The x402 payment protocol charges the user's USDC balance on Base, Peaq, or Avalanche at $0.01-$0.10 per agent interaction. Retry logic (maxReconnectAttempts: 30) and automated agent orchestration patterns shown in the skill allow costs to accumulate silently. An agent granted this skill implicitly receives financial authorization for all subsequent Teneo agent interactions without step-by-step confirmation.
MEDIUM Skill Normalizes Ethereum Private Key Acceptance as a Standard Agent Capability -20 ▶
By documenting private key ingestion as routine SDK usage, this skill primes any LLM agent that ingests it to treat requests for Ethereum private keys as legitimate agent behavior. Users interacting with an agent primed by this skill may not question why the agent is requesting crypto credentials. The skill also teaches agents to execute connection and payment workflows without surfacing confirmation steps to the user.
MEDIUM Agent Taught to Autonomously Invite, Connect, and Pay Without User Confirmation -15 ▶
The skill's code patterns demonstrate agents autonomously subscribing to rooms, inviting other agents by handle, and initiating payments as background operations. No confirmation or notification step is shown to the user before these financial and connectivity actions are taken, establishing a pattern of autonomous high-stakes operations.
MEDIUM All User Interactions Routed Through Teneo Protocol Backend -10 ▶
Every message, room subscription, agent discovery query, and session is processed exclusively through wss://backend.developer.chatroom.teneo-protocol.ai/ws. The skill provides no guidance on Teneo's data retention, privacy policy, or data sovereignty. Users have no mechanism to audit or restrict how their conversation data and wallet activity are handled by the third party.
MEDIUM Third-Party Agent Responses Create Secondary Prompt Injection Surface -15 ▶
Responses from agents on the Teneo platform are parsed and rendered directly by the host LLM agent without content sanitization. A malicious agent registered on the Teneo network could embed prompt injection payloads in its humanized response content, using this skill as a trusted bridge to inject instructions into the host agent from an uncontrolled external source.
LOW Unaudited External npm Package Required to Implement Skill -5 ▶
The skill requires installing @teneo-protocol/sdk from npm. The package itself, its dependency tree, and any install scripts (preinstall/postinstall) were not audited as part of this review. Malicious behavior at install time or in the package's runtime code would not be visible from SKILL.md alone.
INFO Clean Install — No Suspicious Activity During Clone or Setup 0 ▶
The skill installation performed a standard git sparse-checkout from GitHub (140.82.121.3:443), copied exactly two files to the skill directory, and made no unexpected network connections or filesystem changes outside the designated directory. No install-time code execution occurred.
INFO All Canary Files Intact — No Exfiltration Detected 0 ▶
All honeypot files (.env, SSH private key, AWS credentials, .npmrc, Docker config, GCP application default credentials) remained unmodified throughout the audit. Observed file access events at audit sequence #266-271 (pre-install) and #1454-1459 (post-install) are consistent with the oathe audit framework's own baseline and post-install verification routines rather than skill-initiated access.