Security audit
headless-trading
Security checks for vulnerabilities and agentic risk
Overview
The skill's code mostly matches its trading purpose, but there are multiple incoherences and a high-risk behavior (private-key data is prepared and sent to an external swap API) that require attention before use.
Do not use this skill on mainnet or with real/private funds until you or the author fixes and re-audits it. Specific actions to consider before installing or running: 1) Audit and fix swap_solana: it constructs and POSTs base58.b58decode(private_key).hex() to the Jupiter swap API — this will leak secret key material. 2) Correct declared requirements: register SOLANA_PRIVATE_KEY / BNB_PRIVATE_KEY and RPC env vars in the skill metadata and make examples consistently reference those env var names. 3) Run the code in an isolated environment and test exclusively on devnet/testnet with throwaway wallets. 4) Prefer using a signing service or hardware wallet (never raw private keys in process memory or sent to remote endpoints). 5) Ask the publisher for provenance (who published, source repo) — the 'Source: unknown' and missing homepage reduce trust. If you can't fully review/fix the code, avoid supplying live private keys or granting autonomous execution.
SkillSpector findings are pending for this release.