ClawHub
Back to skill

Security audit

KryptoGO Meme Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is for crypto trading, but its default supervised monitoring path can still execute wallet sales without a fresh user confirmation.

Install only after reviewing the trading scripts and using a dedicated low-value wallet. Do not enable cron until the monitor path is made read-only by default or requires an explicit execution flag and fresh approval before signing. Treat remote-built transactions as high risk unless the decoded instructions are independently validated before signing.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/monitor.py:115
Finding

Supervised monitoring can execute unauthorized token sales

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/swap.py:132
Finding

Server-provided opaque transactions are signed without validating their instructions

Content
View full analysis
args.max_impact: sys.exit(f"ABORT: Price impact {price_impact}% exceeds max {args.max_impact}%") elif abs(price_impact) > 5: print(f" ⚠ WARNING: Price impact {price_impact}% is high (>5%)") # Extract estimated output amount for journal estimated_out_amount = 0 try: quote = swap_data.get("quote", {}) # Look for outAmount in quote (structure varies, usually outAmount or amount_out) raw_out = quote.get("outAmount") or quote.get("amount_out") or quote.get("out_amount") if raw_out and decimals is not None: estimated_out_amount = float(raw_out) / (10 ** decimals) except Exception: pass # --------------------------------------------------------------------------- # Step 2: Sign locally # --------------------------------------------------------------------------- print("\nStep 2: Signing transaction locally...") from solders.keypair import Keypair ...[truncated 2722 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/setup.py:64
Finding

Setup automatically installs unpinned Python packages from an uncontrolled package index

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (135)

Tainted flow: 'headers' from os.environ.get (line 56, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/deep-analysis-workflow.py (reported line 19)May include surrounding context.

python
"""Fetches token overview to get total supply and other metadata."""
    headers = {"Authorization": f"Bearer {API_KEY}"}
    url = f"{API_BASE}/token-overview?address={token_mint}&chain_id={chain_id}"
    response = requests.get(url, headers=headers)
    if response.status_code != 200:
        die(f"Failed to get token overview: {response.status_code} {response.text}")
    data = response.json()

Tainted flow: 'headers' from os.environ.get (line 56, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/deep-analysis-workflow.py (reported line 31)May include surrounding context.

python
"""Fetches token overview to get total supply and other metadata."""
    headers = {"Authorization": f"Bearer {API_KEY}"}
    url = f"{API_BASE}/token-overview?address={token_mint}&chain_id={chain_id}"
    response = requests.get(url, headers=headers)
    if response.status_code != 200:
        die(f"Failed to get token overview: {response.status_code} {response.text}")
    data = response.json()

Tainted flow: 'headers' from os.environ.get (line 56, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/deep-analysis-workflow.py (reported line 71)May include surrounding context.

python
"after": after_timestamp,
    }
    
    response = requests.post(url, json=payload, headers=headers)
    if response.status_code != 200:
        # API might fail if the list of wallets is too long.
        # In a real implementation, this should be batched.

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 259)May include surrounding context.

python
def get_token_overview(token_address):
    """Get token metadata: name, price, market cap, holders, risk level."""
    resp = requests.get(
        f"{API_BASE}/token-overview",
        params={"address": token_address},
        headers=HEADERS,

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 270)May include surrounding context.

python
def analyze_token(token_mint):
    """Get full cluster analysis: clusters, top holders, address metadata."""
    resp = requests.get(f"{API_BASE}/analyze/{token_mint}", headers=HEADERS)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 277)May include surrounding context.

python
def get_cluster_changes(token_mint, include_top_holders=True):
    """Get cluster holding ratio and changes across time periods."""
    resp = requests.get(
        f"{API_BASE}/analyze-cluster-change/{token_mint}",
        params={"include_top_holders": str(include_top_holders).lower()},
        headers=HEADERS,

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 288)May include surrounding context.

python
def get_wallet_labels(token_mint, wallets):
    """Get behavior labels for wallets: smart_money, whale, blue_chip_profit, high_frequency."""
    resp = requests.post(
        f"{API_BASE}/wallet-labels",
        json={"token_mint": token_mint, "wallets": wallets},
        headers=HEADERS,

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 299)May include surrounding context.

python
def get_token_wallet_labels(token_mint):
    """Get token-specific labels: developer, sniper, bundle, new_wallet."""
    resp = requests.post(
        f"{API_BASE}/token-wallet-labels",
        json={"token_mint": token_mint},
        headers=HEADERS,

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 375)May include surrounding context.

python
Always passes wallet_address so the returned transaction uses the agent's
    wallet as fee payer / signer (required for local signing).
    """
    resp = requests.post(
        f"{API_BASE}/agent/swap",
        headers=HEADERS,
        json={

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 401)May include surrounding context.

python
def submit_transaction(signed_tx_b64):
    """Submit a signed transaction to the Solana network."""
    resp = requests.post(
        f"{API_BASE}/agent/submit",
        headers=HEADERS,
        json={"signed_transaction": signed_tx_b64},

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 466)May include surrounding context.

python
params = {}
    if wallet_address:
        params["wallet_address"] = wallet_address
    resp = requests.get(f"{API_BASE}/agent/portfolio", headers=HEADERS, params=params)
    resp.raise_for_status()
    return resp.json()

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 492)May include surrounding context.

python
"page_size": str(scan_count),
        **filters,
    }
    resp = requests.get(f"{API_BASE}/agent/trending-tokens", headers=HEADERS, params=params)
    resp.raise_for_status()
    return resp.json()["tokens"]

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 676)May include surrounding context.

python
def check_account_tier():
    """Check agent account tier."""
    try:
        resp = requests.get(f"{API_BASE}/agent/account", headers=HEADERS, timeout=5)
        if resp.status_code == 200:
            return resp.json().get("tier", "free").lower()
    except Exception:

Tainted flow: 'HEADERS' from os.environ.get (line 48, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · examples/trading-workflow.py (reported line 693)May include surrounding context.

python
"page_size": str(scan_count)
    }
    try:
        resp = requests.get(f"{API_BASE}/signal-dashboard", headers=HEADERS, params=params)
        resp.raise_for_status()
        # Adapt response to match trending tokens structure if needed
        data = resp.json()

Tainted flow: 'headers' from os.getenv (line 58, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cron_monitor.py (reported line 59)May include surrounding context.

python
try:
            import requests
            headers = {"Authorization": f"Bearer {os.getenv('KRYPTOGO_API_KEY')}"}
            resp = requests.get(
                f"https://wallet-data.kryptogo.app/token-overview",
                params={"address": token_mint},
                headers=headers

Tainted flow: 'headers' from os.environ.get (line 68, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cron_scan.py (reported line 72)May include surrounding context.

python
# Use quicknode or kryptogo api to get decimals
            # We'll try KryptoGO token-overview first as it's used elsewhere
            print(f"Fetching decimals for {token_mint} to prepare SELL...")
            resp = requests.get(
                "https://wallet-data.kryptogo.app/token-overview",
                params={"address": token_mint},
                headers=headers,

Tainted flow: 'WALLET' from os.environ.get (line 10, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/monitor.py (reported line 35)May include surrounding context.

python
# Fetch Portfolio
try:
    resp = requests.get(
        "https://wallet-data.kryptogo.app/agent/portfolio",
        headers={"Authorization": f"Bearer {API_KEY}"},
        params={"wallet_address": WALLET},

Tainted flow: 'API_KEY' from os.environ.get (line 9, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/monitor.py (reported line 84)May include surrounding context.

python
# CLUSTER DUMP CHECK
        try:
            cluster_resp = requests.get(
                f"https://wallet-data.kryptogo.app/analyze-cluster-change/{mint}",
                headers={"Authorization": f"Bearer {API_KEY}"},
                timeout=5

Tainted flow: 'HEADERS' from os.environ.get (line 64, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/swap.py (reported line 108)May include surrounding context.

python
# Fetch token info for journal
token_info = {}
try:
    resp = requests.get(
        f"{API_BASE}/token-overview",
        params={"address": args.token_mint},
        headers=HEADERS,

Tainted flow: 'HEADERS' from os.environ.get (line 64, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/swap.py (reported line 142)May include surrounding context.

python
print(f"=== BUY: {args.amount} SOL ({amount_raw} lamports) → {token_symbol} (price: ${current_price}) ===")

print("\nStep 1: Building swap transaction...")
swap_resp = requests.post(
    f"{API_BASE}/agent/swap",
    headers=HEADERS,
    json={

Tainted flow: 'HEADERS' from os.environ.get (line 64, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/swap.py (reported line 206)May include surrounding context.

python
# ---------------------------------------------------------------------------

print("\nStep 3: Submitting signed transaction...")
submit_resp = requests.post(
    f"{API_BASE}/agent/submit",
    headers=HEADERS,
    json={"signed_transaction": signed_tx_b64},

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The public description focuses on trading/analysis but the skill also handles local wallet generation, secret storage, package installation, and environment modification. Those are sensitive setup operations that expand the attack surface; omitting them from the primary description reduces informed consent and may lead users to grant risky permissions they did not anticipate.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The public description focuses on trading/analysis but the skill also handles local wallet generation, secret storage, package installation, and environment modification. Those are sensitive setup operations that expand the attack surface; omitting them from the primary description reduces informed consent and may lead users to grant risky permissions they did not anticipate.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The public description focuses on trading/analysis but the skill also handles local wallet generation, secret storage, package installation, and environment modification. Those are sensitive setup operations that expand the attack surface; omitting them from the primary description reduces informed consent and may lead users to grant risky permissions they did not anticipate.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The public description focuses on trading/analysis but the skill also handles local wallet generation, secret storage, package installation, and environment modification. Those are sensitive setup operations that expand the attack surface; omitting them from the primary description reduces informed consent and may lead users to grant risky permissions they did not anticipate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.