KryptoGO Meme Trader

• Outcome: Review
• Latest audit: May 28, 2026 · 9:11 AM UTC
• Version: 2.6.0

Overview

This is a disclosed crypto trading skill, but its default monitoring path can execute live sells despite documentation saying supervised mode only notifies the user.

Install only after careful review. Use a dedicated low-value Solana wallet, do not reuse a main wallet, avoid default cron/monitor.py until the auto-sell behavior is fixed or fully understood, and keep ~/.openclaw/workspace/.env and memory/trading-*.json protected. Treat the backend shutdown notice as active: analysis-based safeguards may no longer work reliably after 2026-05-04.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  {pkg} -- already installed")
        except ImportError:
            print(f"  {pkg} -- installing...")
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", pkg],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

• Confidence: 96% confidence
• Finding: The setup script automatically runs 'pip install' at execution time, which performs network access and installs code into the local Python environment before the rest of the wallet setup proceeds. In a security-sensitive wallet bootstrap script, this expands the trust boundary to PyPI/package resolution and can lead to arbitrary code execution through malicious, compromised, or dependency-confused packages.

Tainted flow: 'HEADERS' from os.environ.get (line 64, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

# ---------------------------------------------------------------------------

print("\nStep 3: Submitting signed transaction...")
submit_resp = requests.post(
    f"{API_BASE}/agent/submit",
    headers=HEADERS,
    json={"signed_transaction": signed_tx_b64},

• Confidence: 86% confidence
• Finding: The script submits a locally signed transaction back to a remote service after signing a server-provided opaque transaction blob. Even though the private key is not directly transmitted, this design lets the remote service control what the user signs unless the transaction contents are independently decoded and validated before signing.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script continues to depend on a backend explicitly documented as shutting down, including analysis, portfolio, and swap-related paths. In a trading skill, stale or unavailable infrastructure can cause failed checks, degraded risk controls, misleading outputs, or unsafe automation decisions when protections silently stop working.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script is presented as a cron-based discovery scan, but it dynamically loads a trading workflow and can execute live swaps automatically every 30 minutes. In a trading skill context, this is especially dangerous because analysis/discovery automation crossing into autonomous fund-moving behavior can cause repeated unintended trades, losses, or abuse without an operator present.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The code returns a fabricated success-like object with placeholder tx_hash and explorer_url values instead of the real transaction result, despite comments implying compatibility with expected transaction semantics. This can mislead upstream logic into believing a trade succeeded, breaking auditability, error handling, reconciliation, and potentially triggering follow-on actions on false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: This monitoring script crosses from observation into autonomous execution by spawning a trade script when heuristic triggers fire. In a trading skill, that makes mistakes or manipulated upstream data materially dangerous because a read-only monitor can now sell assets without an explicit human approval step.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The security comments are materially misleading because the code signs an opaque transaction supplied by the server and returns the signed result for broadcast. While the private key is not transmitted, the server can still potentially induce unauthorized or harmful actions if the client does not verify what is being signed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The discovery pipeline can automatically buy a token and submit a signed transaction without an explicit user confirmation step. In a high-risk meme-coin trading context, autonomous execution materially increases the chance of unauthorized or unintended financial loss if analysis is wrong, APIs are compromised, or token data is manipulated.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The exit path can automatically sell or reduce positions without a mandatory confirmation from the user. Because this code controls real assets, an erroneous signal, manipulated market data, or service malfunction could trigger unwanted liquidation and irreversible losses.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill instructs persistent logging of detailed trade history, reasoning, and outcomes into memory files without any guidance on retention limits, redaction, access controls, or user consent. In an autonomous trading context, these files can accumulate sensitive financial behavior data that may be exposed to other skills, operators, backups, or future prompts, creating privacy and profiling risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This cron job can execute real trades automatically every five minutes based on portfolio conditions, with no interactive confirmation, secondary approval, or dry-run safeguard. In a trading skill, that is especially dangerous because asset swaps are irreversible and a logic error, bad data feed, or manipulated input can immediately cause financial loss.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The cron job invokes discover_and_analyze() and may execute trades without any interactive confirmation, acknowledgement, or separate execution gate. In the context of a wallet-connected meme-coin trading skill, unattended periodic execution is highly risky because volatile assets and external signals can rapidly convert analysis bugs or manipulated inputs into real financial loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script automatically executes sells based on external API data and local heuristics with no interactive confirmation, no rate limiting, and no secondary safety checks. In this skill context that is especially dangerous because false positives, backend errors, or manipulated cluster signals can directly trigger irreversible asset liquidation.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The script sends a wallet address together with an authenticated API request to a third-party service, exposing portfolio metadata and linking the user's identity or wallet activity to that provider. In a trading skill, this data flow is functionally expected, but the lack of explicit runtime notice or consent increases privacy and operational risk, especially because the backend is remote and handles sensitive financial information.

External Transmission

Medium

• Category: Data Exfiltration

Content

# ---------------------------------------------------------------------------

print("\nStep 3: Submitting signed transaction...")
submit_resp = requests.post(
    f"{API_BASE}/agent/submit",
    headers=HEADERS,
    json={"signed_transaction": signed_tx_b64},

• Confidence: 84% confidence
• Finding: The script transmits a signed transaction to a remote server for submission, which is inherently sensitive because the signed payload authorizes on-chain actions. In this context the danger is amplified by the fact that the transaction originates from the same remote service and is not locally verified before signing.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

API_BASE = "https://wallet-data.kryptogo.app"
API_KEY = os.environ.get("KRYPTOGO_API_KEY")
WALLET = os.environ.get("SOLANA_WALLET_ADDRESS")
PRIVATE_KEY = os.environ.get("SOLANA_PRIVATE_KEY")

SOL_MINT = "So11111111111111111111111111111112"

• Confidence: 88% confidence
• Finding: The script reads a Solana private key from the environment and uses it to sign a remote-provided opaque transaction. In a trading skill, access to a live wallet private key is highly sensitive, and the absence of transaction decoding/verification makes this especially dangerous because it can authorize asset transfers beyond the user's intent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Default Mode: Supervised

By default, the agent operates in **supervised mode**: it analyzes tokens, presents recommendations, and waits for user approval before executing any trade. Stop-loss/take-profit conditions are reported to the user but not auto-executed.

To enable autonomous trading, set `require_trade_confirmation: false` in preferences. See `references/autonomous-trading.md` for full details.

• Confidence: 89% confidence
• Finding: The skill explicitly supports disabling trade confirmation and enabling autonomous buy/sell behavior, which allows an agent to make irreversible financial transactions without per-trade user approval. In the context of speculative meme-coin trading, this materially increases the chance of rapid financial loss, especially if analysis inputs are wrong, manipulated, or unavailable after backend shutdown.

Credential Access

High

• Category: Privilege Escalation

Content

network:
        - wallet-data.kryptogo.app
      permissions:
        - filesystem:write:~/.openclaw/workspace/.env
        - filesystem:write:~/.openclaw/workspace/memory/
      runtime_installs:
        - "pip: solders, requests (installed by scripts/setup.py on first run)"

• Confidence: 92% confidence
• Finding: The skill requests write access to `~/.openclaw/workspace/.env`, and the documentation states that setup will generate and store a Solana private key there. Storing long-lived API keys and signing keys in a general dotenv file inside a writable workspace increases the blast radius of any compromise, accidental exposure, or misuse by other tools in the same environment.

Credential Access

High

• Category: Privilege Escalation

Content

source ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-default

# Autonomous mode (opt-in): auto-buys and auto-sells
source ~/.openclaw/workspace/.env && bash scripts/cron-examples.sh setup-autonomous

# Remove all cron jobs
bash scripts/cron-examples.sh teardown

• Confidence: 94% confidence
• Finding: The documented workflow repeatedly instructs users to `source ~/.openclaw/workspace/.env` before running scripts, which loads secrets into the shell environment for downstream commands and cron jobs. This broadens exposure of credentials to child processes, logs, debugging output, shell history mistakes, and any invoked script or dependency that can read environment variables.

Static analysis

No suspicious patterns detected.