stakechain-mcp@r1

VERIFIED· install only

Publisher claims: "Live Base staking and lending yields as agent tools — Morpho vaults and Aave V3 reserves, with rates read from the protocols themselves rather than a third-party snapshot. Adds a daily APY/TVL history and a market profile (curator fee, vault age, allocation concentration), so an agent can tell a rate that has held from one that appeared yesterday." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher abstract36 · publishing for 3 daysInstalls 0Last detonated 3d ago

$npx skills add stakechain-mcp

Watch Report an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.

Tested: every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for: PRIVATE_KEYConfiguration, not credentials: ADAPTER, AMOUNT, ANALYST_PK, API, BASE_RPC, GAS_COST_USD, INTERNAL_PAYERS, OFT_ARBITRUM, OFT_BERACHAIN, OFT_ROBINHOOD, PAY_TO, PRICE_USDC, REACT_APP_CHAIN, REACT_APP_FAUCET_ADDRESS, REACT_APP_STACH_ADDRESS, REACT_APP_STACH_DEPLOY_BLOCK, REACT_APP_YIELDS_API, RECIPIENT, REWARDS_PK, REWARDS_RPC, REWARDS_START_BLOCK, STACH_ADDRESS, STACH_HOLDER, STAKECHAIN_API, STAKECHAIN_INTERNAL_KEY
Where it talks to: no vendor host named in the codeAlso publicnode.com, base.org, basescan.org, blockscout.com, relay.link, arbitrum.io, layerzeroscan.com, uniswap.org, li.quest, llama.fi, defillama.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: use of the skill by an agent

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names publicnode.com, base.org, basescan.org, blockscout.com, relay.link, arbitrum.io, layerzeroscan.com, uniswap.org, li.quest, llama.fi, defillama.com as well as its own vendor. The guard injects PRIVATE_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is stakechain-mcp@r1 safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

0.0sprocessscript backend runs setup only

0.0sprocessno install scripts to re-run

Static findings

HIGH

Access to sensitive file pathsbridge/scripts/fund-arbitrum.js:4 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesrequire("dotenv").config({ path: "../contracts/.env" });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packageagents/analyst/daily-brief.sh:22 · npx invocation of non-well-known package — may execute untrusted code# claude from PATH when installed, otherwise via npxFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageagents/README.md:18 · npx invocation of non-well-known package — may execute untrusted codeclaude mcp add stakechain -- npx -y stakechain-mcpFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packageagents/mcp-server/server.js:13 · npx invocation of non-well-known package — may execute untrusted code// claude mcp add stakechain -- npx -y stakechain-mcpFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsdashboard/src/scenes/staking.jsx:217 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files<code>.env</code> once deployed. The contract is audited and coveredFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packageagents/analyst/daily-brief.sh:23 · npx invocation of non-well-known package — may execute untrusted codeCLAUDE_BIN="${CLAUDE_BIN:-$(command -v claude || echo "npx -y @anthropic-ai/claude-code")}"Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebridge/scripts/send.js:8 · npx invocation of non-well-known package — may execute untrusted code// npx hardhat run scripts/send.js --network arbitrumFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagebridge/scripts/send.js:6 · npx invocation of non-well-known package — may execute untrusted code// npx hardhat run scripts/send.js --network baseFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionagents/recipes/rebalance-weekly.js:129 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("Staying put:");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagebridge/scripts/wire.js:5 · npx invocation of non-well-known package — may execute untrusted code// npx hardhat run scripts/wire.js --network <base|berachain|robinhood>Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagecontracts/scripts/sample-script.js:4 · npx invocation of non-well-known package — may execute untrusted code// When running the script with `npx hardhat run <script>` you'll find the HardhatFix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈36 tok

1 file · 78 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.