Solana Memecoin Guardian v2

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:59 AM UTC
• Version: 1.0.0

Overview

The skill matches its trading purpose, but live mode can automatically sign real Solana trades with weak controls and has bugs that can misreport exits.

Review carefully before installing for live use. Keep it in paper mode unless you have audited the code, use only a dedicated low-balance trading wallet, protect private keys and API tokens, avoid custom API base URLs unless you fully trust them, and fix the live exit-state bugs and transaction-validation gaps before allowing autonomous trades with real funds.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/providers/swapExecutor.ts:38

Finding

Remote Swap Transactions Are Signed Without Instruction Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/monitor.ts:104

Finding

Live Take-Profit and Trailing-Stop Branches Delete Positions Without Selling Tokens

Content

View full analysis

0) { if (price >= pos.tp2Usd && pos.remainingPct > (100 - cfg.exits.tp1_sell_pct - cfg.exits.tp2_sell_pct)) { // sell TP2 chunk once const pct = cfg.exits.tp2_sell_pct; if (mode === "paper") await sellSim(mint, pct); pos.remainingPct = Math.max(0, pos.remainingPct - pct); events.push({ mint, reason: "TAKE_PROFIT_2" }); logger.info({ mint, pct }, "TP2 partial sell"); } else if (price >= pos.tp1Usd && pos.remainingPct === 100) { const pct = cfg.exits.tp1_sell_pct; if (mode === "paper") await sellSim(mint, pct); pos.remainingPct = Math.max(0, pos.remainingPct - pct); events.push({ mint, reason: "TAKE_PROFIT_1" }); logger.info({ mint, pct }, "TP1 partial sell"); } } // Trailing stop on remaining if (pos.remainingPct > 0) { const trailStop = pos.peakPriceUsd * (1 - pos.trailingStopPct / 100); if (price <= trailStop && pos.peakPriceUsd > pos.entryPriceUsd) { if (mode === "paper") await sellSim(mint, pos.remainingPct); positions.delete(mint); events.push({ mint, reason: "TRAILING_STOP" }); logger.info({ mint }, "TRAILING_STOP => EXIT"); continue; } } ``` ### Technical Analysis The take-profit and trailing-stop branches execute `sellSim` only when `mode === "paper"`. No corresponding `sellLiveExactIn` call exists for live mode. Despite not submitting a live sale: - TP1 and TP2 reduce `pos.remainingPct`. - The trailing-stop branch deletes the position from the monitored map. - Logs and generated events claim that a partial sale or exit occurred. This creates a divergence between local state and actual on-chain holdings. The failure is especially dangerous because the stop-loss and liquidity-drop branches elsewhere in the same function do invoke `sellLiveExac ...[truncated 1552 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

Quick start

bash

npm install
cp .env.example .env
npm run dev -- --mode paper --minutes 10

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/live_setup.md (reported line 21)May include surrounding context.

Quick start

bash

npm install
cp .env.example .env
npm run dev -- --mode paper --minutes 10

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/live_setup.md (reported line 22)May include surrounding context.

bash

npm install
cp .env.example .env
# edit .env
npm run dev -- --mode live --minutes 30

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trailing-stop branch deletes the position in both modes, but only performs a sell in paper mode. In live mode this creates a dangerous state mismatch: the bot believes the asset was exited and stops monitoring it, while the live wallet may still hold the tokens and remain exposed to further price collapse.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This function signs and broadcasts a live Solana swap using the loaded private key with no in-function authorization gate, interactive confirmation, or policy check. In an agent skill context, that means any upstream caller able to invoke this path can trigger irreversible asset movement, making accidental or unauthorized trades much more dangerous than in a purely local script.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This sell path also signs and submits an irreversible blockchain transaction without an explicit authorization or confirmation control at the point of execution. Because it can liquidate held tokens based on caller-supplied parameters, the agent context amplifies the risk of unintended sales, abuse by a compromised upstream component, or prompt-driven misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports live trading mode and automated transaction signing, which implies the ability to move real funds irreversibly. Without a clear warning that live mode can execute real on-chain swaps, incur slippage/fees, and cause unrecoverable losses, users may enable or invoke it without informed consent. In the context of autonomous memecoin trading, this omission is more dangerous because the assets are highly volatile and the strategy is designed to react automatically to noisy market and social signals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This is a markdown file, so SQP-2 applies to missing warnings about behaviors affecting privacy or system integrity. The instructions explicitly direct the user to store a bearer token, but do not include any caution about protecting secrets, avoiding commits, or limiting exposure of credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This script prints the entire loaded configuration object to stdout, which can expose secrets such as API keys, tokens, passwords, or internal endpoints if they are included in the runtime config. Even if intended for debugging, stdout is often captured by CI logs, terminals, process managers, and support artifacts, turning a local debug action into a broader credential disclosure risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This file can automatically execute live sell transactions based on streamed wallet events, with no user-facing confirmation, approval checkpoint, or prominent runtime disclosure in the execution path. In a trading bot context, silent autonomous execution is security-relevant because a bad config, compromised event source, or logic error can immediately trigger real asset loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code logs that live mode is not implemented, but elsewhere in the same file it already performs live buy and live sell execution paths. This mismatch is dangerous because operators may rely on the warning and assume no real trades will occur, when in fact funds can be spent or liquidated automatically under certain branches.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code performs a live asset sale via sellLiveExactIn, which is a safety-critical and potentially irreversible operation. Although there is internal logging elsewhere, there is no explicit user-facing confirmation, prompt, or explanatory comment/docstring at this execution point disclosing that a real trade will be submitted when monitoring conditions trigger.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

When stop-loss conditions are met, the function automatically executes a live sell order. This is a destructive financial action, and the code does not include a visible confirmation prompt or nearby warning/comment informing users that monitoring can trigger real trades automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/providers/dexscreener.ts (reported line 22)May include surrounding context.

ts

};

export async function resolveDexScreener(mint: string): Promise<DexMetrics | null> {
  const url = `https://api.dexscreener.com/latest/dex/tokens/${mint}`;
  const data = await httpGetJson<DsTokenPairs>(url);
  const pair = (data.pairs || []).find(p => (p.chainId || "").toLowerCase() === "solana");
  if (!pair) return null;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code accesses sensitive wallet credentials via WALLET_PRIVATE_KEY_BASE58 and WALLET_PRIVATE_KEY_JSON, which is a safety-relevant operation under the rule. In this file there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that the skill reads private key material to sign transactions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest uses a caret range for yaml instead of pinning an exact version, which permits automatic installation of newer releases within the major version. In a security-sensitive Solana-related skill, this weakens supply-chain control and makes builds less reproducible, increasing exposure to vulnerable or malicious package updates.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"lint": "echo \"(optional) add eslint\""
  },
  "dependencies": {
    "yaml": "^2.5.1",
    "zod": "^3.24.1",
    "node-fetch": "^3.3.2",
    "pino": "^9.3.2",

Unverifiable Dependency: yaml has 2 known advisory(ies) (CVE-2026-33532 (yaml is vulnerable to Stack Overflow via deeply nested YAML collections); CVE-2023-2251 (Uncaught Exception in yaml)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

yaml has known advisories and the manifest does not pin an exact version, so it is not possible to verify from this file alone whether deployments resolve to a patched release. If the application parses untrusted YAML, affected versions could be abused for denial of service via crashes or excessive recursion.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The zod dependency is specified with a caret range, so different installs may resolve to different package versions over time. This creates avoidable supply-chain risk and can silently introduce vulnerable releases into a project that may process untrusted input.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json

},
  "dependencies": {
    "yaml": "^2.5.1",
    "zod": "^3.24.1",
    "node-fetch": "^3.3.2",
    "pino": "^9.3.2",
    "pino-pretty": "^11.2.2",

Unverifiable Dependency: zod has 1 known advisory(ies) (CVE-2023-4316 (Zod denial of service vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 74% confidence

Finding

zod has a known DoS advisory, and the use of a version range prevents confirmation that the installed version is fixed. This is mainly dangerous if complex untrusted input is validated in exposed paths, where crafted payloads could consume excessive resources.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

node-fetch is not pinned to an exact version, allowing semver-compatible updates to be pulled in automatically. Because this package handles outbound network requests, supply-chain drift is especially relevant and can introduce security regressions or vulnerable code paths.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"dependencies": {
    "yaml": "^2.5.1",
    "zod": "^3.24.1",
    "node-fetch": "^3.3.2",
    "pino": "^9.3.2",
    "pino-pretty": "^11.2.2",
    "minimist": "^1.2.8",

Unverifiable Dependency: node-fetch has 3 known advisory(ies) (CVE-2022-0235 (node-fetch forwards secure headers to untrusted sites); CVE-2022-2596 (node-fetch Inefficient Regular Expression Complexity ); CVE-2020-15168 (The `size` option isn't honored after following a redirect in node-fetch)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

node-fetch has multiple known advisories, and because the manifest does not pin an exact version, the actual installed package cannot be verified as patched. In a networked agent, this matters because vulnerable fetch behavior can affect header forwarding, redirect handling, or availability under malicious input.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The pino logging dependency is unpinned, which reduces build determinism and increases exposure to unexpected dependency changes. While not directly exploitable on its own, it still represents unnecessary supply-chain risk.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"yaml": "^2.5.1",
    "zod": "^3.24.1",
    "node-fetch": "^3.3.2",
    "pino": "^9.3.2",
    "pino-pretty": "^11.2.2",
    "minimist": "^1.2.8",
    "@solana/web3.js": "^1.98.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

pino-pretty is declared with a caret range, so developers may get differing versions across environments. Even for a formatting/logging package, unreviewed upstream changes can affect the security posture and reproducibility of the build.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"zod": "^3.24.1",
    "node-fetch": "^3.3.2",
    "pino": "^9.3.2",
    "pino-pretty": "^11.2.2",
    "minimist": "^1.2.8",
    "@solana/web3.js": "^1.98.0",
    "bs58": "^5.0.0",

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

minimist is unpinned, which is more concerning because this package has a history of prototype-pollution advisories and processes command-line input. In a tool that may parse user-supplied arguments, version drift can increase the chance of resolving to an affected or otherwise unsafe release.

Content

Scanner excerpt · package.json (reported line 18)May include surrounding context.

json

"node-fetch": "^3.3.2",
    "pino": "^9.3.2",
    "pino-pretty": "^11.2.2",
    "minimist": "^1.2.8",
    "@solana/web3.js": "^1.98.0",
    "bs58": "^5.0.0",
    "dotenv": "^16.4.5"

Unverifiable Dependency: minimist has 2 known advisory(ies) (CVE-2020-7598 (Prototype Pollution in minimist); CVE-2021-44906 (Prototype Pollution in minimist)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

minimist has known prototype-pollution advisories, and the unpinned dependency means the resolved version cannot be validated from the manifest. Since it parses command-line arguments, unsafe versions can be abused to alter object prototypes and destabilize application logic.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/providers/http.ts:7

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/providers/xFilteredStream.ts:13