Wayfinder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:28 PM UTC
• Version: 0.0.4

Overview

The skill is a coherent DeFi trading tool, but it deserves Review because it installs mutable external trading code, stores signing keys locally, and enables live fund-moving commands and scripts with broad local privileges.

Review this carefully before installing. Use only low-balance dedicated wallets, avoid production private keys in config.json, prefer a secret manager or external signer, pin the SDK to a reviewed commit instead of main, avoid curl-piped installers, and require a fresh transaction preview and explicit confirmation for every live trade, bridge, withdrawal, approval, or generated script.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:153
• Finding: Remote Poetry Installer Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:153` **Vulnerability Type**: Remote code retrieval followed by immediate interpreter execution **Risk Level**: Critical ### Vulnerable Code ```bash - **"poetry not found"** — Install poetry: `curl -sSL https://install.python-poetry.org | python3 -` ``` ### Technical Analysis The installation instruction pipes bytes received from an external URL directly into the local Python interpreter. The downloaded payload is neither pinned to a specific immutable version nor verified using a cryptographic signature or trusted digest before execution. HTTPS protects the connection in transit but does not guarantee that the upstream content will remain unchanged or uncompromised. The effective code executed by this Skill can therefore change after the Skill package has been reviewed. The remote installer executes with the permissions of the user following the setup instructions. In the expected deployment environment, that account may have access to the Wayfinder configuration, wallet private keys, API credentials, exchange credentials, shell configuration, and other user files. ### Attack Path 1. An attacker compromises the Poetry installation endpoint, its hosting infrastructure, DNS resolution, or a trusted certificate path. 2. The operator follows the documented troubleshooting instruction. 3. `curl` retrieves the attacker-controlled Python payload. 4. The shell passes the response directly to `python3`. 5. The payload executes without an opportunity for integrity verification or inspection. 6. The payload reads local secrets, modifies the SDK, installs persistence, or communicates stolen data to an external service. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the invoking user. Depending on the deployment, the attacker could: - Read Wayfinder API credentials. - Read plaintext wallet private keys from `config.json`. - Read cent ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | python3` instruction entirely. 2. Prefer installation through a trusted operating-system package manager with signed repository metadata. 3. If direct installation is unavoidable: - Download the installer to a local file. - Pin an immutable installer version. - Verify a publisher-provided cryptographic signature or SHA-256 digest through an independent trusted channel. - Inspect the downloaded file before execution. - Execute it under a minimally privileged account. 4. Do not run the installer from an account that can access production wallet keys. 5. Document the expected installer digest and provenance directly in the Skill. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:25
• Finding: Mutable Upstream SDK Branch Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Locations**: - `references/setup.md:25-40` - `references/setup.md:131-135` - `SKILL.md:51-66` - `sdk-version.md:1` - `skill.json:4` **Vulnerability Type**: Unpinned executable dependency and mutable remote payload **Risk Level**: High ### Vulnerable Code ```bash ### 2. Clone the SDK from GitHub ```bash # Must clone from GitHub — do NOT pip install if [ ! -d "$WAYFINDER_SDK_PATH" ]; then git clone https://github.com/WayfinderFoundation/wayfinder-paths-sdk.git "$WAYFINDER_SDK_PATH" fi cd "$WAYFINDER_SDK_PATH" ``` ### 3. Install Dependencies ```bash cd "$WAYFINDER_SDK_PATH" poetry install ``` ### 4. Run Guided Setup ```bash cd "$WAYFINDER_SDK_PATH" python3 scripts/setup.py ``` ``` The update workflow also retrieves and executes new upstream content: ```bash cd "$WAYFINDER_SDK_PATH" git pull poetry install ``` The nominal SDK version is a mutable branch rather than an immutable commit: ```text main ``` The manifest records the same mutable reference: ```json "sdk_version": "main" ``` ### Technical Analysis The Skill package does not contain the SDK that performs wallet creation, credential management, transaction construction, and signing. Instead, it instructs the operator to clone the current state of the upstream default branch, install its dependencies, and run its setup script. The `main` branch can change after this Skill has been audited. Consequently, the code ultimately executed by an operator may differ substantially from the reviewed package. Running `poetry install` can also install or execute dependency content whose integrity cannot be established from this artifact. The documented `git pull` update workflow further permits later upstream changes to enter a sensitive signing environment without a renewed security review. ### Attack Path 1. An attacker compromises the upstream GitHub repository, a maintainer account, a referenced dependency, or the branch publication workflow. 2. The attac ...[truncated 1195 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `main` with a reviewed, immutable full Git commit hash. 2. Pin all transitive Python dependencies using a committed lockfile with integrity hashes. 3. Require verification of signed releases or signed commits before installation. 4. Audit the exact pinned SDK revision, including `scripts/setup.py`, MCP configuration logic, transaction builders, and signing code. 5. Replace `git pull` with an explicit version-upgrade procedure requiring: - Review of the old-to-new commit diff. - Signature verification. - Automated security testing. - Manual approval before production deployment. 6. Separate dependency installation from the production signing environment. 7. Run the SDK under a dedicated, minimally privileged operating-system account. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:562
• Finding: Wallet Private Keys and API Credentials Are Stored Together in Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:562-591` - `references/setup.md:60-100` **Vulnerability Type**: Plaintext storage and aggregation of high-value credentials **Risk Level**: High ### Vulnerable Code ```json { "system": { "api_base_url": "https://strategies.wayfinder.ai/api/v1", "api_key": "wk_..." }, "strategy": { "rpc_urls": { "1": ["https://eth.llamarpc.com"], "42161": ["https://arb1.arbitrum.io/rpc"], "8453": ["https://mainnet.base.org"], "999": ["https://rpc.hyperliquid.xyz/evm"] } }, "wallets": [ { "label": "main", "address": "0x...", "private_key_hex": "0x..." } ], "ccxt": { "aster": { "apiKey": "", "secret": "" }, "binance": { "apiKey": "", "secret": "" } } } ``` The setup guide explicitly states: ```text `scripts/setup.py` creates random local dev wallets by default (it writes `private_key_hex` into `config.json`). ``` It also describes the configuration as containing: ```text - API keys: Wayfinder API key for pool/token data - RPC endpoints: Chain-specific RPC URLs - Wallets: Wallet labels, addresses, and private keys ``` ### Technical Analysis The documented design stores wallet-signing keys, Wayfinder API credentials, and potentially centralized-exchange credentials in a single plaintext JSON file at a predictable path. No mandatory file-permission control, encryption-at-rest requirement, hardware-backed signer, or process-level separation is documented. Any process that can read this file receives all configured credentials. This includes the remotely installed SDK, generated Python scripts, accidental diagnostic tooling, backup software, and malware running as the same operating-system user. Aggregating unrelated secrets also increases the blast radius of one disclosure. A single file leak may compromise blockchain wallets, Wayfinder access, and exchange accounts simultaneously. ### Attack Path 1. A malicious depen ...[truncated 1269 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace raw private keys with a hardware wallet, remote signer, MPC signer, or operating-system key store. 2. Require per-transaction approval and policy checks in the signing service. 3. Store API and exchange credentials in a dedicated secret manager rather than `config.json`. 4. Keep only non-sensitive wallet addresses and secret references in the configuration file. 5. Separate wallet keys, Wayfinder credentials, and exchange credentials into distinct security domains. 6. If a local secret file remains necessary: - Encrypt it at rest. - Enforce owner-only permissions such as mode `0600`. - Refuse to run if permissions are broader. - Exclude it from version control and backups by default. 7. Use dedicated low-balance wallets and narrowly scoped API keys. 8. Document credential rotation, revocation, and emergency wallet migration procedures. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/setup.md:52
• Finding: API Key Can Be Supplied Through a Process Command-Line Argument<![CDATA[ ## Vulnerability Details **File Location**: `references/setup.md:52` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```text - `--api-key KEY` — Provide API key non-interactively (key from https://strategies.wayfinder.ai) ``` ### Technical Analysis Command-line arguments are not an appropriate secret-transport mechanism. Depending on the operating system and execution environment, arguments may be exposed through: - Shell history. - Process listings. - CI/CD job logs. - Terminal recording. - Audit or endpoint-monitoring telemetry. - Error reports and process metadata. Although some modern systems restrict cross-user process inspection, the command can still be retained in shell history and automation logs. The documentation presents this mechanism as a supported non-interactive setup method without warning about those disclosure channels. ### Attack Path 1. An operator or CI job invokes the setup script with `--api-key wk_...`. 2. The full command is written to shell history, build logs, process telemetry, or a process listing. 3. Another user, log reader, support operator, or compromised monitoring system retrieves the key. 4. The attacker reuses the credential against the Wayfinder service. ### Impact Assessment The exposed privilege is limited to that granted to the Wayfinder API key. Potential impact includes: - Unauthorized API access. - Consumption of quotas or paid resources. - Access to account-associated data. - Impersonation of the configured client. - Additional compromise if the same credential was reused elsewhere. This finding does not establish that wallet private keys are passed through command-line arguments. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove or deprecate the `--api-key KEY` form. 2. Read the credential from protected standard input without echo. 3. Alternatively, accept a secret-manager identifier or restricted file descriptor. 4. For CI/CD, integrate directly with the platform's masked secret facility. 5. Ensure setup and error messages never print the supplied key. 6. Add explicit documentation warning against placing secrets in shell command lines. 7. Rotate keys that may already have appeared in shell history or CI logs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:528
• Finding: Path-Restricted Python Execution Is Incorrectly Described as Sandboxed<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:528-554` - `SKILL.md:733-849` - `references/coding-interface.md:438-448` **Vulnerability Type**: Insufficient isolation for generated code with signing and secret access **Risk Level**: High ### Vulnerable Code ```markdown ### `run_script` — Execute sandboxed Python scripts Run a local Python script in a subprocess. Scripts must live inside the runs directory (`$WAYFINDER_RUNS_DIR` or `.wayfinder_runs/`). | Parameter | Type | Required | Default | Notes | |-----------|------|----------|---------|-------| | `script_path` | string | **Yes** | — | Must be `.py`, must exist, **must be inside the runs directory** | | `args` | string | No | — | Arguments passed to the script (JSON list) | | `timeout_s` | int | No | `600` | Clamped to min 1 second | | `env` | string | No | — | Additional env vars for subprocess (JSON object) | | `wallet_label` | string | No | — | For profile annotation | | `force` | flag | No | `false` | Do not rely on this as a “dry-run vs live” gate. Prefer implementing `--dry-run` / `--force` inside your script and passing it via `--args`. | **Validations:** - Script path must resolve to inside the runs directory (sandboxed — no arbitrary file execution). - Must be a `.py` file. - Must exist on disk. - Output is truncated to 20,000 chars. ``` Generated scripts are also instructed to obtain automatically wired signing access: ```python #!/usr/bin/env python3 import asyncio from wayfinder_paths.mcp.scripting import get_adapter from wayfinder_paths.adapters.moonwell_adapter import MoonwellAdapter async def main(): adapter = get_adapter(MoonwellAdapter, "main") # Auto-wires config + signing success, result = await adapter.lend(mtoken="0x...", amount=100_000_000) print(f"Result: {result}" if success else f"Error: {result}") if __name__ == "__main__": asyncio.run(main()) ``` ### Technical Analysis Restricting the location of a Python source file is a path valid ...[truncated 2215 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Rename the existing protection to “script path restriction” and stop describing it as a sandbox. 2. Execute generated scripts in a dedicated container, microVM, or equivalent operating-system isolation boundary. 3. Apply: - A read-only root filesystem. - A dedicated unprivileged user. - No host filesystem access except an explicit working directory. - No default outbound network access. - An allowlist of required RPC and protocol endpoints. - CPU, memory, process, and execution-time limits. - System-call restrictions where supported. 4. Do not expose raw private keys to scripts. 5. Route signing requests through a separate policy-enforcing signer that validates: - Chain ID. - Recipient and contract allowlists. - Token and amount limits. - Calldata intent. - Slippage and approval limits. - Explicit user confirmation. 6. Enforce dry-run mode in the runner rather than relying on each generated script to implement it correctly. 7. Require a reviewed transaction preview before enabling any live signing operation. 8. Sanitize inherited environment variables and reject arbitrary environment overrides for sensitive names. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This skill describes itself as a DeFi trading tool but also references local dependency discovery, SDK source parsing, git state manipulation, and even modifying packaging metadata such as skill.json. Those behaviors are materially different from trading/portfolio management and, in context, are more dangerous because the same skill also interfaces with wallets and live execution paths; an attacker or mistake could change local code or metadata and influence later executions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This skill describes itself as a DeFi trading tool but also references local dependency discovery, SDK source parsing, git state manipulation, and even modifying packaging metadata such as skill.json. Those behaviors are materially different from trading/portfolio management and, in context, are more dangerous because the same skill also interfaces with wallets and live execution paths; an attacker or mistake could change local code or metadata and influence later executions.

Ae1

High

• Category: analysis-evasion

Content

**Reference**: [references/adapters.md](references/adapters.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

**Reference**: [references/adapters.md](references/adapters.md)

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Self-Modification

High

• Category: Rogue Agent

Content

- skill.json.resources.static/templates (from mcp.resource(...) URIs)
- skill.json.sdk_version (from wayfinder/sdk-version.md)

It does NOT attempt to rewrite SKILL.md or reference docs.
"""

from __future__ import annotations

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs the agent to use shell, read environment variables, and read/write local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host may expose broader capabilities than users or reviewers expect, which is especially risky for a DeFi skill that can access wallets, config files, and execute live fund-moving commands.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document broadly describes many adapters with capabilities such as transfers, swaps, borrowing, withdrawals, order execution, and collateral changes, but it lacks a top-level safety warning that these actions can materially change balances, open positions, or create liquidation risk. Because this skill is specifically for DeFi portfolio management and trading across multiple protocols and chains, omission of a general warning increases the chance of accidental high-impact financial actions by users or downstream agents.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Polymarket section includes live `bridge_deposit` and `buy` execution examples but does not place an explicit warning immediately рядом that these commands move real funds and may be irreversible. In a DeFi trading skill, executable examples are especially risky because users may copy-paste them directly, leading to unintended deposits or trades if they do not recognize the examples as live operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation shows how to configure API credentials and execute real exchange actions such as create_order without any explicit warning about secret handling, account permissions, or the financial consequences of live trading. In a DeFi/CEX trading skill, users may copy examples directly into production workflows, increasing the chance of credential exposure, over-privileged API keys, or unintended real-money trades.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file includes concrete commands for placing market and limit orders, closing positions, updating leverage, and canceling orders. While the file documents mechanics and some operational gotchas, it does not provide a direct warning that these commands can execute real trades, incur losses, or materially affect user funds.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The file provides executable withdrawal commands and mentions fees and timing elsewhere, but the withdrawal section itself lacks a clear warning that the action moves real funds to Arbitrum and may be difficult or impossible to reverse if misdirected. For a markdown skill description, this is a user-impacting operation that should be explicitly disclosed where the command is presented.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### Builder Fee

Builder attribution uses a fixed wallet `0xaA1D89f333857eD78F8434CC4f896A9293EFE65c`. Fee value `f` is in **tenths of a basis point** (e.g. `30` = 0.030%). Set in `config.json` under `strategy.builder_fee`. The CLI auto-approves if needed.

## Spot Orders

• Confidence: 85% confidence
• Finding: The statement that the CLI 'auto-approves if needed' indicates the system may autonomously authorize a builder fee approval transaction without a separate, explicit user consent step at execution time. In a high-risk financial skill, automatic approval of spending/fee permissions can expose users to unintended authorizations, especially if configuration is stale, misunderstood, or manipulated by surrounding orchestration.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- **Slippage**: Default slippage is applied to market orders. Override with `--slippage` (as a decimal, e.g., 0.01 = 1%).
- **No guessing**: Do not invent funding rates or prices. Always fetch via adapter and label timestamps.
- **USD sizing ambiguity**: When a user says "$X at Yx leverage", always clarify if $X is notional (position size) or margin (collateral). See the Sizing table above.
- **Builder fee approvals**: Builder fees are opt-in per user/builder pair. Fee value `f` is in **tenths of a basis point** (e.g. `30` = 0.030%). The CLI auto-approves if needed.
- **Funding history**: There is no `HyperliquidAdapter.get_funding_history()` — use `HyperliquidDataClient` or the SDK's `Info.funding_history()` directly.

• Confidence: 87% confidence
• Finding: Repeating that builder fee approvals are auto-approved if needed reinforces that the tool may take a write action that changes account permissions without a fresh confirmation boundary. In the context of wallet-connected DeFi trading, autonomous approval behavior increases the chance of unintended authorization and makes prompt-injection or orchestration mistakes more dangerous.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation presents a live execution command using `--force` immediately after a dry-run example, but it does not prominently warn that this will broadcast an on-chain transaction and may spend user funds. In a DeFi trading skill, unclear separation between simulation and live execution increases the chance of accidental real trades, especially when users copy-paste examples verbatim.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The file states that the adapter requires a signing wallet and `private_key_hex` without any security warning about secret handling, storage, logging, or exposure risk. In a DeFi automation context, disclosure or misuse of a private key can immediately compromise all assets controlled by that wallet, making this more dangerous than generic credential usage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation presents multiple fund-moving methods as routine adapter calls but does not clearly warn that they can execute irreversible on-chain transactions, consume wallet balances, incur slippage, and expose users to loss from misconfiguration. In a DeFi trading skill, this omission is more dangerous because users may copy scripts directly and treat these methods like safe read-only operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

All strategies support these actions via `poetry run wayfinder run_strategy`:

### Read-Only Actions (no confirmation needed)

| Action | Description |
|--------|-------------|

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _git_current_ref(sdk_root: Path) -> str:
    try:
        out = subprocess.check_output(
            ["git", "-C", str(sdk_root), "symbolic-ref", "-q", "--short", "HEAD"],
            stderr=subprocess.DEVNULL,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except subprocess.CalledProcessError:
        pass

    return subprocess.check_output(
        ["git", "-C", str(sdk_root), "rev-parse", "HEAD"],
        text=True,
    ).strip()

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _git_checkout(sdk_root: Path, ref: str) -> None:
    subprocess.check_call(["git", "-C", str(sdk_root), "checkout", "--quiet", ref])


def _parse_server_py(server_py: str) -> tuple[list[str], list[str]]:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The manifest exposes high-risk capabilities—execution, wallet management, and both network and filesystem access—yet provides no explicit user-facing warning, consent boundary, or indication that actions may move funds or modify local state. In a DeFi trading skill, this omission is especially dangerous because users may trigger irreversible on-chain transactions, asset transfers, or script execution without clear awareness of operational risk.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The guide states 'Direct Execution (bypasses sandbox — use sparingly)' but the example still executes a script located in `.wayfinder_runs/my_script.py`. That contradicts the earlier statement that scripts are sandboxed by directory location, and may mislead users about the actual safety boundary of the example shown.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The text states that the wallet in `config.json` must include a `private_key_hex` and labels this as "local dev only," but more importantly the document hard-codes Polygon-specific behavior throughout the skill without presenting it as an optional regional or locale choice. This is a natural-language policy concern only insofar as the skill constrains use to a specific environment/context without offering user choice or documenting opt-in flexibility.

External Script Fetching

Low

• Category: Supply Chain

Content

- **"Python 3.10 not supported"** — Ensure Python 3.12+ is installed and poetry uses it
- **"Missing config"** — Run `python3 scripts/setup.py` or create `config.json` manually
- **"api_key not set"** — Check `config.json` has `system.api_key`, or set `WAYFINDER_API_KEY` env var. Key format: `wk_...`
- **"poetry not found"** — Install poetry: `curl -sSL https://install.python-poetry.org | python3 -`
- **"just not found"** — Install just: `cargo install just` or `brew install just`
- **Key not working** — Verify at https://strategies.wayfinder.ai, check for typos/whitespace. Key should start with `wk_`. Verify with: `poetry run python -c "from wayfinder_paths.core.clients.WayfinderClient import WayfinderClient; print('API key configured!')"`

• Confidence: 95% confidence
• Finding: The documentation recommends piping a remote script directly into the Python interpreter (`curl ... | python3 -`), which executes unverified code fetched at runtime. If the upstream server, transport, or install script is compromised, a user following the setup guide could execute arbitrary code on the host system.