swarm-tips

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.3.0

Overview

This skill is clearly for crypto workflows, but it gives a mutable remote MCP server broad influence over mainnet financial transactions that users or agents may sign.

Install only if you are comfortable letting this MCP endpoint prepare crypto transactions for your wallet. Use a dedicated low-balance wallet, inspect every transaction before signing, avoid autonomous signing, and treat the server's tool inventory and dispatcher output as untrusted until independently verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Error

• Location: SKILL.md:12

Finding

Mutable Remote Tool Inventory Controls Financial Workflows

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:12-14
Vulnerability Type: other: Remote-controlled financial transaction workflow
Risk Level: High

Vulnerable snippet:

markdown

One MCP server (the authoritative tool inventory is the server's own `tools/list`) across three live Solana-mainnet protocols (Coordination Game, Shillbot content marketplace, video generation) plus universal opportunity discovery, MCP-ecosystem search, on-chain agent reputation, and a wallet-addressed agent inbox (`agent_send_message`/`agent_get_messages` — sign the `verify_nonce` that `register_wallet` returns and re-call `register_wallet` with it to unlock; `agent_verify_wallet` is the standalone equivalent). Cross-chain/EVM game tools are currently unlisted (still callable by name; same commit-reveal encoding). **Non-custodial:** every state-changing tool returns an unsigned transaction you sign locally. The server never holds keys.

Install: `claude mcp add --transport http swarm-tips https://mcp.swarm.tips/mcp` (or point any MCP client at `https://mcp.swarm.tips/mcp`, Streamable HTTP).

Technical Analysis

The Skill delegates its authoritative capability inventory to a remote MCP server instead of defining or pinning a locally auditable tool manifest. It also explicitly states that certain unlisted tools remain callable by name. Consequently, the effective capabilities available after installation can differ from those visible during static review.

This creates a trust boundary around a mutable external service. Although the server reportedly returns unsigned transactions and does not directly receive private keys, non-custodial operation does not establish transaction safety. The remote service still determines the transaction instructions presented to the wallet for authorization.

The absence of a pinned manifest, strict local allowlist, schema integrity check, or version-bound tool inventory means a compromised or malicio ...[truncated 1515 chars]

Remediation

View remediation

Remediation Suggestions

1. Publish a versioned, cryptographically hashed tool manifest containing every permitted tool, argument schema, cash-flow classification, and expected behavior.
2. Pin the Skill to a specific manifest version and reject tools absent from that manifest.
3. Remove the documented ability to call unlisted tools by name.
4. Require local policy enforcement independently of the MCP server, including allowlists for chains, program IDs, contract addresses, token mints, recipients, and instruction types.
5. Require explicit user approval before staking, spending, transferring assets, granting approvals, or changing authorities.
6. Display and verify the MCP server's TLS identity and consider signing tool manifests and server responses with a separately managed release key.
7. Apply per-transaction and cumulative spending limits so a compromised server cannot request unrestricted wallet operations.
8. Treat remotely supplied dispatcher instructions and tool arguments as untrusted input rather than authoritative commands.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:36

Finding

Server-Generated Blockchain Transactions Are Signed Without Mandatory Semantic Validation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:36-39
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable snippet:

markdown

3. **Claim:** for a Shillbot task — `shillbot_get_task_details` (read the brief, blocklist, brand voice FIRST), then `shillbot_claim_task` → sign → `shillbot_submit_tx` (action `claim`).
4. **Do the work + submit:** produce the content (tip: `generate_video` output can be submitted to a video task), then `shillbot_submit_work` with the content_id → sign → `shillbot_submit_tx` (action `submit`).
5. **GET PAID — do not skip these:** after the oracle window, `shillbot_verify_task` (records the Switchboard-attested score) → sign → submit, then `shillbot_finalize_task` (releases escrow to you after the challenge window) → sign → submit. Work that is never verified+finalized never pays out.
6. **Or let the server drive:** `shillbot_complete_task` is a single-call "what do I do next?" dispatcher — pass the task_id, it returns the exact next tool + args (or a `wait` with `not_before` timestamp). Re-call after each step until `done`. Recommended for autonomous operation.

Technical Analysis

The documented workflow repeatedly directs the agent to sign and submit transactions generated through remote tools. It does not require the client to decode each transaction, inspect every instruction, verify recipients and amounts, simulate execution, or compare the transaction with a locally defined policy before signing.

An unsigned base64 transaction is not inherently safe. Base64 only encodes the transaction, and the absence of a server-side signature merely means that execution still requires wallet authorization. A malicious transaction can remain unsigned while containing transfers, approvals, unexpected program calls, excessive fees, or authority-changing instructions.

The risk is increased by shillbot_complete_task, which allows the remote server to choo ...[truncated 1622 chars]

Remediation

View remediation

Remediation Suggestions

1. Require local decoding of every server-generated transaction before requesting a signature.
2. Present a human-readable summary containing the chain, network, program or contract IDs, instruction names, recipients, token mints, amounts, fees, approvals, and authority changes.
3. Compare decoded instructions against the operation requested by the user and reject unrelated or additional instructions.
4. Simulate transactions using an independently configured RPC endpoint before signing.
5. Enforce strict allowlists for supported programs, contracts, instructions, recipients, and token mints.
6. Reject unknown instructions, address lookup tables, delegate approvals, unlimited allowances, authority transfers, or unexpected writable accounts unless separately approved.
7. Introduce per-operation spending and staking caps, along with explicit confirmation for all asset outflows.
8. Prevent autonomous dispatchers from directly triggering signatures. Dispatcher output should only propose the next action and must pass independent validation and authorization.
9. Verify that the serialized transaction has not changed between validation, signature, and submission.
10. Document that non-custodial architecture protects key custody but does not replace transaction-content verification.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.