LP Agent

• Outcome: Review
• Latest audit: May 28, 2026 · 11:02 AM UTC
• Version: 1.0.1

Overview

This appears to be a real crypto liquidity-provision skill, but it needs Review because it can control live wallets and trading infrastructure while shipping weak credentials and unsafe install/reset behaviors.

Install only in an isolated environment you control. Change all API, config, and broker credentials before adding any wallet, keep services bound to localhost, avoid running the installer as root on a host, do not pass private keys on the command line, use a dedicated low-balance wallet, and review stop, reset, direct Gateway, and database-repair actions before running them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'req' from os.environ.get (line 42, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = f"http://{GATEWAY_HOST}:{GATEWAY_PORT}/connectors/meteora/clmm/pool-info?network=mainnet-beta&poolAddress={address}"
    req = urllib.request.Request(url, headers={"Accept": "application/json"})
    try:
        with urllib.request.urlopen(req, timeout=10) as resp:
            return json.loads(resp.read().decode()), None
    except urllib.error.URLError as e:
        return None, f"Gateway not reachable at {GATEWAY_HOST}:{GATEWAY_PORT}"

• Confidence: 85% confidence
• Finding: with urllib.request.urlopen(req, timeout=10) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs execution of shell commands, network access, file generation, and environment-based authentication, but it declares no permissions. This creates a transparency and governance gap: a host may expose capabilities to the skill without users or policy engines understanding the full risk surface, especially since the skill can deploy infrastructure, import wallets, query services, and write reports.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The stated description frames the skill as a liquidity-provision assistant, but the documented behavior goes far beyond that into infrastructure deployment, wallet import, RPC configuration, service management, exports, and browser-opening dashboards. This mismatch can cause users or automated reviewers to underestimate the operational and financial risk, especially because the skill touches private keys and live trading infrastructure.

Context-Inappropriate Capability

High

• Confidence: 93% confidence
• Finding: The README explicitly supports supplying a wallet private key via a command-line flag. Passing secrets on the command line can expose them through shell history, process listings, audit logs, CI logs, and terminal recordings, creating a direct path to wallet compromise and asset theft.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: This script clearly performs wallet administration, including listing wallets, importing a wallet, and querying balances, which exceeds the stated scope of an LP-strategy skill. Scope expansion is security-relevant because it introduces sensitive key-handling and account-management capabilities that increase blast radius and make abuse easier if the skill is invoked unexpectedly or repurposed.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code accepts a raw private key from CLI input or an interactive prompt and transmits it to an API endpoint, creating a direct secret-handling path. Even if intended for legitimate wallet import, handling plaintext private keys in an LP automation skill is highly dangerous because compromise of the local host, process memory, logs, or the destination API can lead to irreversible wallet theft.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script writes a fake sudo wrapper into /usr/local/bin when running as root and sudo is absent. This is a privileged host modification unrelated to deploying a trading API, alters expected system command behavior globally, and could cause later commands or users to execute with unintended privileges or trust a spoofed binary.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The non-interactive path hardcodes admin, config, and broker credentials and writes them to the environment file. Predictable default credentials are commonly discovered and reused, making unauthorized access much easier if the service is exposed locally, in Docker networks, or accidentally published.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill tells users to paste a Solana private key for trading without a prominent warning that this grants control over live funds and could lead to irreversible asset loss if mishandled. In a trading skill, this context makes the omission more dangerous because the entire workflow is designed to operate with real wallets and on-chain transactions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documented reset command stops and removes deployed infrastructure but does not clearly warn about service interruption, configuration loss, and possible deletion of operational data. In this skill's context, reset affects trading infrastructure and may disrupt bots or access to wallet-connected services, making accidental execution materially risky.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The documentation publishes default API credentials of admin/admin without a strong instruction to change them immediately. Even if bound to localhost by default, weak default credentials are routinely reused or exposed through port forwarding, Docker networking, reverse proxies, or misconfiguration, enabling unauthorized control of trading infrastructure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide instructs operators to manually mark executor records as `TERMINATED` in the database when on-chain and in-memory state diverge, but it does not warn that direct database edits can create inconsistent state, hide active positions, or break accounting/audit trails. In a financial automation context, undocumented manual state tampering can lead to orphaned positions, incorrect portfolio reporting, and unsafe follow-on actions by the agent or user.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The exception path tells users to close an on-chain position directly via `manage_gateway_clmm` when the executor is missing, without clearly warning that this is an asset-affecting, potentially irreversible operation that may realize losses, unwind exposure, and desynchronize internal state. In an LP management skill, such instructions are more dangerous because they directly control live DeFi positions and could trigger unintended liquidation of the strategy state.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The guide promotes an automated strategy that opens, closes, and retries on-chain liquidity actions, but it does not present a prominent upfront warning that users are authorizing autonomous trading with real financial loss risks, including slippage, impermanent loss, failed-close scenarios, and repeated transaction submission. In an agent skill context, omission of this warning is security-relevant because users may enable the skill without understanding that it can move funds and continue retrying transactions on their behalf.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation presents `add --private-key <BASE58_KEY>` as a normal usage path without warning that command-line arguments are commonly recoverable from shell history, process monitors, orchestration logs, and support artifacts. Because this skill manages blockchain wallets, exposure of a private key would immediately endanger funds and account control.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently writes insecure default credentials into .env without requiring acknowledgement or warning the operator. In a deployment script for automated trading infrastructure, this increases the chance that a user unknowingly runs a sensitive service with trivial credentials protecting API and broker access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Creating a sudo shim in /usr/local/bin without a prominent warning is dangerous because it changes host command semantics in a persistent, privileged location. Users and later processes may assume they are invoking the real sudo binary, masking privilege boundaries and enabling unsafe execution patterns.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The reset command irreversibly stops containers, removes volumes, and deletes the installation directory without confirmation. This is hazardous because users may invoke it accidentally or through automation and lose configuration, bot state, and database contents needed for a trading deployment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The stop-and-archive command triggers a destructive operational action immediately, with no confirmation prompt, dry-run mode, or explicit warning to the user. In a trading-bot management context, this increases the chance of accidental archival or shutdown of active bots, which can interrupt trading, lose local state, or complicate recovery during live financial operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The stop command performs a state-changing action immediately and may close an on-chain position unless --keep-position is supplied, with no interactive confirmation or dry-run warning. In a trading context this increases the chance of operator error, accidental liquidation/closure, and unintended financial loss if the wrong executor ID is provided.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script silently falls back to default API credentials of admin/admin when environment variables are unset, which can enable unauthorized access if the target Hummingbot API is configured similarly or if operators assume credentials are required. In a script that can start, stop, restart, reconfigure networks, and retrieve logs, weak defaults materially increase the chance of service takeover or sensitive information exposure.

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Load .env
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
    if [ -f "$f" ]; then
        set -a; source "$f"; set +a

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Load .env
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
    if [ -f "$f" ]; then
        set -a; source "$f"; set +a
        break

• Confidence: 87% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Load .env
for f in hummingbot-api/.env ~/.hummingbot/.env .env; do
    if [ -f "$f" ]; then
        set -a; source "$f"; set +a
        break

• Confidence: 87% confidence
• Finding: .env

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.