Security audit

Pumpclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real blockchain token-launch tool, but it asks for a wallet private key and runs financial transactions through under-scoped and partly unaudited tooling.

Review this carefully before installing. Use only a dedicated low-balance wallet, avoid exporting valuable private keys into a broad shell environment, do not run the unpinned npx commands as written, and verify the missing shared contract/ABI files and every transaction target before signing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/swap.ts:77
Finding: Token swaps execute without slippage protection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:41
Finding: Unpinned packages are downloaded and executed with wallet credentials in the environment
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/pumpclaw.ts:16
Finding: Transaction-critical modules are imported from outside the audited project
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is framed primarily as revenue infrastructure and token deployment, but the documented behavior includes active trading (buy/sell) and direct spending from a wallet private key. This mismatch can mislead users or agent operators about the true risk envelope, causing them to authorize a deployment tool that can also execute market trades and spend funds.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 96% confidence
Finding: The lockfile pins ws to version 8.18.3, and the supplied advisory data indicates this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial-of-service issue. Even though ws appears as a transitive dependency through viem and is marked as a peer in one place, package-lock.json shows it is actually resolved into the dependency graph, so consumers installing from this lockfile may deploy the vulnerable version.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs use of a sensitive environment variable (BASE_PRIVATE_KEY) but does not declare any tool scope or permissions boundary. In an agent setting, missing explicit scope makes secret access implicit and increases the chance that a host grants broader capabilities than the user expects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README encourages token deployment, claiming fees, and buy/sell operations without explicit warnings that these are irreversible financial transactions subject to loss, slippage, and user error. In an agent skill context, missing safety language increases the chance of blind execution by users or orchestrators who may assume commands are low risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation tells users to place a wallet private key in an environment variable but provides no warning about secret handling, hot-wallet risk, or exposure through logs/process environments. In a skill designed for agents and automation, this omission is particularly dangerous because secrets may be broadly accessible to tools, subprocesses, or telemetry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill repeatedly recommends npx tsx execution without pinning package versions. Unpinned npx usage creates a supply-chain risk because a changed or compromised upstream package version can execute arbitrary code at runtime on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This command again relies on unpinned npx tsx, which may pull different package code over time. In a skill that handles private keys and initiates on-chain actions, dynamic package resolution materially increases compromise impact.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: npx pumpclaw-mcp is an unpinned remote package execution path. Because MCP servers may gain powerful access to agent context, tools, and possibly secrets, fetching the latest package at execution time is a significant supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: npx pumpclaw-cli deploy executes an unpinned package that can change behavior between runs. Since this CLI is intended to deploy tokens and may access wallet credentials, a compromised or malicious update could exfiltrate keys or submit unintended transactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This documentation instance still promotes unpinned npx tsx execution. Repetition across the README normalizes insecure operational practice and broadens the attack surface for users following copy-pasted commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Another unpinned npx tsx invocation exposes users to arbitrary upstream code changes. The risk is amplified because the skill is tied to financial operations on a blockchain wallet.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This command continues the same unpinned package execution pattern. In a workflow involving token inspection and possible follow-on transactions, compromised tooling can mislead users or stage later theft.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The create-token command is executed via unpinned npx tsx, allowing arbitrary package drift. Because this action can produce irreversible on-chain transactions, malicious dependency changes could alter transaction targets or parameters.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This image-enabled create command still uses unpinned npx tsx. A compromised package could harvest metadata, private keys, or submit unexpected contract calls while appearing to perform normal deployment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The website-enabled create flow also depends on unpinned npx tsx. Recommending dynamic tool retrieval in a wallet-connected DeFi skill is a real supply-chain weakness, not just documentation style.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This FDV customization command retains the same unpinned execution risk. Financially meaningful parameters can be tampered with by compromised tooling before signing or broadcast.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The custom supply command still invokes unpinned npx tsx. In token-launch workflows, altered dependency code could misstate supply, route ownership incorrectly, or substitute malicious contract addresses.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The relayer-pattern command is also unpinned. Because it supports creation on behalf of another creator, compromised tooling could abuse attribution or wallet routing in ways users may not notice immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Fee-checking via unpinned npx tsx remains a supply-chain risk. Even read-oriented commands can deceive users about balances or encourage subsequent malicious actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The fee-claim command uses unpinned execution in a transaction-signing context. A malicious upstream dependency could redirect fee claims or trigger unintended approvals/transfers.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The buy command combines unpinned npx tsx with direct ETH spending. This is especially dangerous because arbitrary code execution plus immediate financial authority can lead to rapid wallet drain or unauthorized trades.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The sell command also relies on unpinned npx tsx in a sensitive transaction context. A compromised package could alter sell amounts, destinations, or approvals and cause direct asset loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Metadata update commands are still executed via unpinned npx tsx. While lower impact than swaps, compromised tooling could still hijack creator-only privileges or perform additional hidden actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This website update command repeats the unpinned execution risk. In aggregate, the documentation consistently directs users toward insecure package execution practices around privileged wallet operations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The by-creator listing command uses unpinned npx tsx, preserving the same supply-chain weakness. This specific instance is less dangerous than trade or claim commands but still permits arbitrary code execution in the user's environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.