ClawHub
Back to skill

Security audit

Token Launcher - Token Launch Pad

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed token-launching guide with real financial and blockchain risk, but its sensitive actions are aligned with its stated purpose and are not hidden.

Install only if you want token launch guidance. Before any launch, claim, fee-recipient update, or hosted API request, require an explicit confirmation that names the chain, wallet, token, recipient, service endpoint, payment amount, and irreversible effect. Use dedicated minimally funded wallets, pin dependencies, verify contract addresses, and do not share private keys.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/clanker.md:16
Finding

Unpinned Security-Critical Blockchain Dependencies

Content
View full analysis

Vulnerability Details

File Location: references/clanker.md:16, references/flaunch.md:16, and references/pumpfun.md:16
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippets

references/clanker.md:16:

bash
npm install clanker-sdk viem

references/flaunch.md:16:

bash
npm install viem

references/pumpfun.md:16:

bash
npm install @solana/web3.js @solana/spl-token

Technical Analysis

These installation commands do not specify exact dependency versions or integrity constraints. Consequently, npm resolves mutable package versions available at installation time rather than a release that was explicitly audited by the project.

This is particularly sensitive because the referenced packages construct blockchain transactions, interact with RPC services, and may receive access to funded signing wallets. A malicious, compromised, or unexpectedly incompatible dependency release could alter transaction calldata, destination contracts, fee-recipient addresses, or signing and submission behavior.

The installation guidance also conflicts with the recommendation in REFERENCE.md:37 to pin package versions. The repository contains no implementation lockfile that would make these example installations reproducible.

Attack Path

  1. A developer follows one of the documented npm install commands.
  2. npm resolves the latest package release and its transitive dependency graph.
  3. An upstream package or transitive dependency has been compromised, maliciously replaced, or published with unsafe behavior.
  4. The developer imports the package into an application that has RPC connectivity and access to a dedicated funded signing wallet.
  5. The compromised dependency changes transaction destinations, calldata, fee-recipient configuration, or transaction submission behavior.
  6. The application signs or submits the manipulated transact ...[truncated 761 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace each installation command with exact, reviewed package versions, for example package-name@x.y.z.
  2. Provide a minimal reference implementation with a committed package-lock.json.
  3. Instruct users to install reproducibly with npm ci rather than resolving mutable versions with an unconstrained npm install.
  4. Verify package provenance, maintainers, registry source, and integrity metadata before approving dependency updates.
  5. Review transitive dependencies and use automated supply-chain scanning, such as lockfile auditing and dependency alerts.
  6. Apply dependency updates deliberately after reviewing release changes and testing transaction destinations, calldata, fee recipients, and signing behavior.
  7. Continue using dedicated wallets with minimal balances and require transaction simulation plus human verification of destination addresses and fee-recipient configuration before signing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · REFERENCE.md (reported line 3)May include surrounding context.

md
# Token Launcher — Direct Mode Reference

> **This file is developer documentation only.** It contains code examples and integration patterns for developers to implement in their own codebase. This skill does not execute any code, does not access environment variables, and does not handle private keys at runtime. All code samples below are reference material — they run in your infrastructure, not in this skill.

Direct Mode means integrating with Clanker, Flaunch, or Pump.fun directly from your own application code. You keep 100% of creator fees — no interface cut, no platform overhead.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · REFERENCE.md (reported line 180)May include surrounding context.

After deploying via any platform, run a Quick Intel scan to verify the contract looks clean from an external perspective:

bash
curl -X POST https://x402.quickintel.io/v1/scan/full \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <x402_payment>" \
  -d '{"chain": "base", "tokenAddress": "0xYourDeployedToken"}'

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is very broad and includes generic phrases like 'launch a token', 'token economics', and 'is this a good token', which can cause the skill to activate in contexts where the user did not explicitly request deployment guidance. In a skill that includes operational instructions for token launching and fee-handling, unintended invocation increases the chance the agent steers users toward risky financial or blockchain actions without sufficiently clear consent.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

md
### API Input Safety

The Tator API accepts a `prompt` field — this is a **parameter name for an external API call to Tator's trading service**, not a prompt for the agent's own LLM. The value is sent to `x402.quickintel.io` where Tator's server parses it and executes the requested operation. The API is server-side validated and only processes recognized trading operations. It does not execute arbitrary code or access filesystems.

The `PAYMENT-SIGNATURE` header shown in the examples is a wallet-signed USDC payment authorization created by the user's x402-compatible wallet. It is not an API key, stored secret, or environment variable — it is generated per-request by the wallet and verified on-chain by the API.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill contains concrete instructions to send wallet-linked requests and signed payment authorizations to an external service at x402.quickintel.io. Even though no private key is directly shared, this still enables transmission of sensitive transactional intent and payment authorization to a third party, and in this context the action can trigger irreversible on-chain token deployment or fee operations.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

Launch a Token

bash
curl -X POST https://x402.quickintel.io/v1/tator/prompt \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <x402_payment>" \
  -d '{

Static analysis

No suspicious patterns detected.