Kamino Positions Monitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:19 PM UTC
• Version: 1.0.0

Overview

The skill is openly aimed at Kamino liquidation monitoring, but it asks users to download and run mutable external Node.js code that is not included in the reviewed package.

Review the external GitHub project before installing, prefer a pinned commit or signed release, use npm ci with a reviewed lockfile when possible, and run it with only the wallet list, RPC URL, and Telegram credentials needed for the current task.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:27

Finding

Mutable External Repository and Unpinned Dependencies Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–31 and 39
Vulnerability Type: Remote payload retrieval and insecure software supply chain
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/csacanam/kamino-positions-monitor
cd kamino-positions-monitor && npm install

bash

cd "${KAMINO_MONITOR_PATH:-.}" && node kamino_monitor.js wallets.json

Technical Analysis

The installation instructions clone the current default branch of an external Git repository without pinning it to a reviewed commit hash or signed release. The effective code executed by the Skill can therefore change after this artifact has been audited.

The subsequent npm install also installs dependencies without a visible, audited lockfile in this artifact. Package installation may execute lifecycle scripts such as preinstall, install, and postinstall. Finally, node kamino_monitor.js wallets.json directly executes the externally retrieved application. Neither that script nor its dependency tree is present in the audited project, so its behavior and integrity cannot be verified here.

Although there is no direct evidence that the current upstream repository or its dependencies are malicious, the documented workflow creates a remote payload execution and supply-chain trust boundary.

Attack Path

1. An attacker compromises the upstream GitHub repository, its maintainer account, or a dependency selected during npm install.
2. The attacker adds a malicious package lifecycle script, modifies kamino_monitor.js, or publishes a compromised dependency version.
3. A user follows the documented setup and clones the mutable default branch.
4. npm install executes a malicious lifecycle script, or the malicious payload executes when the user invokes node kamino_monitor.js wallets.json.
5. The payload runs with the privileges of the user running Node and can access resourc ...[truncated 696 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the external repository to a specific reviewed commit hash or cryptographically signed release rather than cloning a mutable default branch.
2. Vendor the executable source into the Skill package where feasible so that the runtime code can be audited together with the instructions.
3. Include and review a lockfile, then use npm ci to install the exact dependency graph.
4. Use npm ci --ignore-scripts when package lifecycle scripts are unnecessary. If scripts are required, explicitly audit and allowlist them.
5. Verify release signatures, commit signatures, and artifact checksums before installation or execution.
6. Run the monitor under a dedicated, least-privileged account or sandbox with narrowly restricted filesystem and network access.
7. Provide only the environment variables required for the current operation. Keep Telegram and RPC credentials out of globally inherited environments.
8. Add automated dependency vulnerability, provenance, and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions include very broad phrases such as "liquidation" and "DeFi monitoring," which can match many user requests outside the narrow Kamino-on-Solana use case. This can cause unintended invocation of the skill, leading the agent to run blockchain-monitoring logic in contexts where it is irrelevant, potentially exposing wallet-related workflows or producing misleading financial guidance.

Content

No source excerpt is available for this finding.