Security audit

Soma

Security checks for vulnerabilities and agentic risk

Overview

The skill is aligned with SOMA setup, but it should be reviewed carefully because it asks users to run unverified installers, handle wallet and cloud secrets, and deploy recurring blockchain workloads.

Install only after reviewing the installer and quickstart source, pinning trusted versions where possible, and using a dedicated testnet wallet with limited value. Treat SOMA_SECRET_KEY, HF_TOKEN, S3 credentials, and Modal secrets as sensitive; avoid bulk-uploading unrelated .env values, scope cloud tokens tightly, and understand that Modal jobs, public S3/R2 uploads, staking, claiming, and cron deployments can create lasting cost, privacy, and blockchain effects.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:62
Finding: Unverified Remote Installer Executed Directly by a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:71
Finding: Mutable Upstream Project and Insufficiently Pinned Dependencies Execute with Sensitive Credentials
Content: View full analysis
=0.1.7", "soma-models[torch]>=0.1.7", "datasets", "torch", "boto3", "aiohttp", ) ) cpu_image = modal.Image.debian_slim(python_version="3.13").pip_install( "soma-sdk>=0.1.7", "boto3", "python-dotenv", ) ``` ### Technical Analysis The quickstart repository is fetched without selecting an audited commit hash or authenticated release tag. Its default branch can change after this Skill is reviewed. The resulting source is then used to install dependencies, read `.env`, push secrets to Modal, make blockchain transactions, upload data, and deploy scheduled remote workloads. The package declarations further permit mutable dependency resolution: - `soma-sdk>=0.1.7` and `soma-models[torch]>=0.1.7` allow any future compatible version selected by the resolver. - `datasets`, `torch`, `boto3`, `aiohttp`, and `python-dotenv` have no versions specified in the documented i ...[truncated 2714 chars]
Remediation: View remediation
=` constraints in deployed images. 6. Require installation modes that reject packages not present in the approved lockfile. 7. Review the cloned source, lockfile, build hooks, and package metadata before providing any credentials. 8. Replace transfer of the entire `.env` dictionary with an explicit allowlist: ```python allowed_names = { "SOMA_SECRET_KEY", "HF_TOKEN", "S3_BUCKET", "S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY", "S3_ENDPOINT_URL", "S3_PUBLIC_URL", } env = dotenv.dotenv_values(".env") approved = {name: env[name] for name in allowed_names if env.get(name)} Secret.create_or_update("soma-secrets", approved) ``` 9. Separate secrets by workload so the GPU scoring or training process receives only the credentials it requires. A component that only reads datasets should not receive a wallet signing key or S3 write credentials. 10. Scope the S3 token to one bucket and only the required object prefixes and operations. 11. Use a dedicated testnet wallet with a limited balance rather than a broadly funded key. 12. Replace `stake_amount=None` with an explicit, user-confirmed amount and require confirmation before any financial transaction. 13. Disable automatic recurring deployment until the exact source, dependencies, permissions, schedule, and expected costs hav ...[truncated 228 chars]

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.
md
name: soma description: Expert guide for participating in the SOMA network — a decentralized system that trains a foundation model through competition. Provides data submission workflows, model training pipelines, reward claiming, SDK code generation, CLI command guidance, and competitive strategy optimization. Use when user mentions "SOMA", "soma-sdk", "soma-models", "submit data to SOMA", "train a SOMA model", "SOMA targets", "SOMA rewards", "next-byte prediction network", "decentralized model training", or asks about earning SOMA tokens through data or model contributions. Do NOT use for general machine learning, PyTorch, or JAX questions unrelated to the SOMA network. license: Apache-2.0 compatibility: Requires Python 3.10+ for soma-sdk, Python 3.13+ for quickstart. soma CLI installed via sup. GPU recommended for model training (H100) and scoring (24GB VRAM). Network access to SOMA testnet or localnet. Requires env vars SOMA_SECRET_KEY (sensitive — Ed25519 signing key), HF_TOKEN (sensitive — HuggingFace access), S3_BUCKET, S3_ACCESS_KEY_ID (sensitive), S3_SECRET_ACCESS_KEY (sensitive), S3_ENDPOINT_URL, S3_PUBLIC_URL. All credentials stored in .env (gitignored) and pushed to Modal encrypted secret store. Use testnet keys only. metadata: author: soma-org version: 1.1.0

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
name: soma description: Expert guide for participating in the SOMA network — a decentralized system that trains a foundation model through competition. Provides data submission workflows, model training pipelines, reward claiming, SDK code generation, CLI command guidance, and competitive strategy optimization. Use when user mentions "SOMA", "soma-sdk", "soma-models", "submit data to SOMA", "train a SOMA model", "SOMA targets", "SOMA rewards", "next-byte prediction network", "decentralized model training", or asks about earning SOMA tokens through data or model contributions. Do NOT use for general machine learning, PyTorch, or JAX questions unrelated to the SOMA network. license: Apache-2.0 compatibility: Requires Python 3.10+ for soma-sdk, Python 3.13+ for quickstart. soma CLI installed via sup. GPU recommended for model training (H100) and scoring (24GB VRAM). Network access to SOMA testnet or localnet. Requires env vars SOMA_SECRET_KEY (sensitive — Ed25519 signing key), HF_TOKEN (sensitive — HuggingFace access), S3_BUCKET, S3_ACCESS_KEY_ID (sensitive), S3_SECRET_ACCESS_KEY (sensitive), S3_ENDPOINT_URL, S3_PUBLIC_URL. All credentials stored in .env (gitignored) and pushed to Modal encrypted secret store. Use testnet keys only. metadata: author: soma-org version: 1.1.0

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.
md
name: soma description: Expert guide for participating in the SOMA network — a decentralized system that trains a foundation model through competition. Provides data submission workflows, model training pipelines, reward claiming, SDK code generation, CLI command guidance, and competitive strategy optimization. Use when user mentions "SOMA", "soma-sdk", "soma-models", "submit data to SOMA", "train a SOMA model", "SOMA targets", "SOMA rewards", "next-byte prediction network", "decentralized model training", or asks about earning SOMA tokens through data or model contributions. Do NOT use for general machine learning, PyTorch, or JAX questions unrelated to the SOMA network. license: Apache-2.0 compatibility: Requires Python 3.10+ for soma-sdk, Python 3.13+ for quickstart. soma CLI installed via sup. GPU recommended for model training (H100) and scoring (24GB VRAM). Network access to SOMA testnet or localnet. Requires env vars SOMA_SECRET_KEY (sensitive — Ed25519 signing key), HF_TOKEN (sensitive — HuggingFace access), S3_BUCKET, S3_ACCESS_KEY_ID (sensitive), S3_SECRET_ACCESS_KEY (sensitive), S3_ENDPOINT_URL, S3_PUBLIC_URL. All credentials stored in .env (gitignored) and pushed to Modal encrypted secret store. Use testnet keys only. metadata: author: soma-org version: 1.1.0

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remote script directly into bash executes unaudited code from the network with the user's privileges. In this skill, that risk is amplified because the surrounding workflow subsequently handles wallet secret keys and cloud credentials, so a compromised installer path could immediately lead to credential theft or system compromise.
Content: Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
Step 1: Install CLI and Create Wallet

bash
curl -fsSL https://sup.soma.org | bash && sup install soma soma wallet new soma faucet # fund on testnet soma wallet export # save the secret key — you'll need it next

Credential Access

High

Category: Privilege Escalation
Confidence: 81% confidence
Finding: The instruction to run uv run create-secrets and push .env contents to Modal moves a bundle of highly sensitive credentials into a third-party platform. While this may be operationally legitimate, the skill gives no verification, scoping, rotation, or least-privilege guidance for that transfer, so misuse or compromise of the Modal account could expose signing keys, S3 keys, and API tokens.
Content: Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.
bash
# Sign up at modal.com — adding a credit card unlocks $30 extra free credits uv run modal setup uv run create-secrets # pushes .env to Modal uv run modal run src/quickstart/submitter.py # test run

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This repeats the same unsafe install pattern in an example workflow, normalizing direct execution of a remote script. Because the skill is about setting up blockchain wallets and secret-bearing infrastructure, successful compromise at install time could cascade into theft of signing keys, tokens, or malicious tampering with the toolchain.
Content: Scanner excerpt · SKILL.md (reported line 459)May include surrounding context.
md
User says: "Install SOMA and help me start contributing" / "Set up SOMA and start submitting data" Actions: 1. Install soma CLI (`curl -fsSL https://sup.soma.org | bash && sup install soma`) 2. Create wallet (`soma wallet new && soma faucet && soma wallet export`) 3. Fork the quickstart repo, run `uv sync` 4. Walk through each `.env` credential — explain what it does and where to get it

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The installation instructions pipe a remotely fetched script directly into bash, which executes unreviewed code from the network in the user's shell. If the hosting domain, TLS trust, CDN path, or upstream script is compromised, users can be subjected to arbitrary code execution, credential theft, wallet exfiltration, or system compromise.
Content: Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.
bash
# Install via sup (version manager) curl -fsSL https://sup.soma.org | bash sup install soma # Verify

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | bash construct is the dangerous execution step that turns a remote content fetch into immediate code execution without review. In a skill focused on blockchain tooling and wallets, this is especially risky because the same environment may hold private keys, config files, and credentials that malware or a malicious installer could steal.
Content: Scanner excerpt · references/cli-reference.md (reported line 11)May include surrounding context.
bash
# Install via sup (version manager) curl -fsSL https://sup.soma.org | bash sup install soma # Verify

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 29)May include surrounding context.
bash
git clone https://github.com/soma-org/quickstart cd quickstart cp .env.example .env # Fill in .env with your credentials (see Getting Started in SKILL.md) uv sync

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: The instruction to fill a .env with credentials directly precedes workflows involving a blockchain secret key and cloud credentials, but gives no caution about using a dedicated wallet, protecting the file, or avoiding source-control exposure. Because SOMA_SECRET_KEY can control on-chain actions and S3 keys can expose storage, insecure handling here can lead to account compromise, data loss, or fund theft.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 30)May include surrounding context.
git clone https://github.com/soma-org/quickstart cd quickstart cp .env.example .env

Fill in .env with your credentials (see Getting Started in SKILL.md)

uv sync

text

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: This line introduces a configuration block that includes an exported ed25519 secret key and multiple cloud credentials, effectively instructing users to centralize highly sensitive secrets in plaintext. In the context of a decentralized network with reward claims and model operations, compromise of these values can enable unauthorized transactions, reward theft, and storage abuse.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 49)May include surrounding context.

Modal account (GPU orchestration)

SOMA binary (via sup install soma)

.env Configuration

text
SOMA_SECRET_KEY=<ed25519 secret key from `soma wallet export`>

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The documentation directs users to push secrets from .env into Modal, a third-party platform, without any warning about verifying account trust, limiting team access, or understanding that a wallet private key is being transmitted to external infrastructure. That omission is especially dangerous because the secret set includes both blockchain and cloud credentials with real operational value.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 64)May include surrounding context.
Modal Secrets Setup

python
# Push .env to Modal as a secret group # Run: python -m quickstart.create_modal_secret from modal import Secret import dotenv

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: Reading the entire .env and bulk-uploading it as a secret group encourages indiscriminate propagation of all local secrets, including any accidental extras beyond the intended SOMA variables. This broadens blast radius and can leak unrelated credentials into the remote execution environment, where compromise or misconfiguration could expose them.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 69)May include surrounding context.
from modal import Secret import dotenv

env = dotenv.dotenv_values(".env") Secret.create_or_update("soma-secrets", env)

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation includes a secret key export command without any warning about the sensitivity of the output or the risk of exposing wallet credentials. In a crypto/network CLI context, exported keys can directly enable theft of funds, unauthorized transactions, or account takeover if copied, logged, or pasted into insecure environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The wallet removal command is documented without warning that deleting a wallet entry can cause irreversible loss of access if the user has not securely backed up the secret key or recovery material. In this skill's cryptocurrency setting, that can lead to permanent loss of funds and signing capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document explicitly instructs users to download competitor model weights and winning submission data from the network and reuse them for fine-tuning, distillation, and evaluation, but it provides no caution about provenance, licensing, trust boundaries, or the risks of ingesting untrusted third-party artifacts. In a skill that may be followed operationally, this can normalize unsafe handling of external model/data inputs and lead to supply-chain, legal, or data-handling issues if malicious or restricted content is fetched and incorporated blindly.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 14)May include surrounding context.
md
| File | Purpose | When to fork/modify | |------|---------|-------------------| | `src/quickstart/submitter.py` | Full data submission pipeline on Modal (L4 GPU). Streams Stack v2, scores, uploads to S3, submits on-chain. Deploys as 24h cron. | Changing data source, filtering logic, target selection strategy, or scoring parameters | | `src/quickstart/training.py` | Complete train-commit-reveal loop on Modal (H100). Supports both PyTorch and Flax. Includes localnet mode for testing. Auto-deploys cron for reveals every 6h. | Changing training hyperparameters, data pipeline, checkpoint schedule, or adding custom training logic | | `src/quickstart/train_torch.py` | Standalone PyTorch training reference (no commit/reveal). Simpler entry point for understanding the training loop. | Learning the training loop before customizing `training.py` | | `src/quickstart/train_flax.py` | Standalone Flax/JAX training reference. | Using Flax instead of PyTorch | | `src/quickstart/common.py` | Shared utilities: training state management, checkpoint helpers, S3 upload, artifact saving. Used by all other modules. | Adding new state fields, changing checkpoint format, or modifying S3 upload logic |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly instructs users to place a private wallet key and cloud credentials in a local .env file and then upload the entire file into a third-party secret store without any warning about key sensitivity, least-privilege, or trust boundaries. In a crypto and cloud context, these secrets can authorize fund movement, data submission, and storage access, so normalizing this workflow without safety guidance materially increases the chance of credential compromise or misuse.
Content: No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

Category: Data Exfiltration
Confidence: 55% confidence
Finding: Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
Content: Scanner excerpt · references/quickstart-patterns.md (reported line 160)May include surrounding context.
aws_secret_access_key=os.environ["S3_SECRET_ACCESS_KEY"], ) bucket = os.environ["S3_BUCKET"] s3.put_object(Bucket=bucket, Key=key, Body=data) return f"{os.environ['S3_PUBLIC_URL']}/{key}"

text

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The training-state examples persist decryption keys, embeddings, weights, and related model artifacts to local files without warning that these files may contain sensitive material that enables model recovery or reveal operations. On shared workstations, CI runners, or synced volumes, this can expose proprietary model data or operational secrets to unintended parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The SDK reference shows direct restoration and export of secret keys and mnemonics without any warning that these values are highly sensitive and must never be logged, shared, hardcoded, or committed to source control. In a blockchain context, disclosure of these credentials enables full account compromise and irreversible theft or misuse of on-chain assets and authority.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The data submission and scoring examples accept raw data bytes and public URLs, but do not warn that submitted content may be transmitted to external scoring services, published at accessible URLs, or otherwise exposed beyond the local environment. Users may unknowingly submit confidential, regulated, or proprietary data to third-party infrastructure, causing privacy or compliance breaches.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The reference documents transfers, staking, unstaking, and validator-management operations as simple API calls without highlighting that they trigger real on-chain state changes that may be irreversible, delayed, or financially risky. Users may test these methods against the wrong network or account and unintentionally move funds, lock stake, change validator state, or submit punitive reports with lasting consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The section explicitly encourages generating and submitting synthetic data to the SOMA network but does not warn about provenance, policy compliance, quality validation, or whether model-generated content is permitted by the platform and source licenses. In a competitive reward-oriented skill, this omission can lead users to submit disallowed, low-quality, or derivative model outputs at scale, creating policy, legal, and ecosystem integrity risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document demonstrates loading a private key directly from the SOMA_SECRET_KEY environment variable and immediately using it for signing without any nearby warning about secret handling, least-privilege usage, or safe storage. While this is common in SDK examples, it can normalize unsafe copy-paste behavior and lead users to expose production secrets in shells, notebooks, logs, or shared environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T08 · Insecure Dependencies

SkillSpector

Credential Access

Credential Access

Credential Access

External Script Fetching

Step 1: Install CLI and Create Wallet

Credential Access

External Script Fetching

External Script Fetching

Chaining Abuse

Credential Access

Credential Access

Fill in .env with your credentials (see Getting Started in SKILL.md)

Credential Access

.env Configuration

Credential Access

Modal Secrets Setup

Credential Access

Missing User Warnings

Missing User Warnings

Missing User Warnings

Autonomous Decision Making

Missing User Warnings

Cloud Storage Exfiltration

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis