ClawHub
Back to skill

Security audit

Optionns

Security checks for vulnerabilities and agentic risk

Overview

This is a documented devnet betting bot, but it needs Review because it stores signing keys and blindly signs blockchain instructions supplied by its API.

Install only in an isolated environment with a throwaway Solana Devnet keypair and mock funds. Do not reuse any real wallet or mainnet key, verify the API and RPC endpoints yourself, and avoid autonomous mode unless you accept that the remote service can shape transactions that the local keypair will sign.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/signer.py:103
Finding

Unvalidated API-Provided Solana Instructions Are Signed by the Local Keypair

Content
View full analysis
&1) fi ``` ### Technical Analysis The Optionns API controls every security-sensitive component of the transaction instructions: - Program IDs - Account public ...[truncated 2435 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/signer.py:25
Finding

Devnet RPC Allowlist Can Be Bypassed with a Deceptive Hostname

Content
View full analysis
None: """ Enforce devnet-only operation by validating RPC URL. Raises: ValueError: If RPC URL does not contain a devnet pattern """ ALLOWED_DEVNET_PATTERNS = [ "devnet.solana.com", "api.devnet.solana.com", "devnet.helius-rpc.com", "rpc.devnet.soo.network", "devnet.rpcpool.com", "localhost", # Allow local devnet validator "127.0.0.1" # Allow local devnet validator ] # Check if URL contains any allowed devnet pattern url_lower = rpc_url.lower() if not any(pattern in url_lower for pattern in ALLOWED_DEVNET_PATTERNS): raise ValueError( f"SECURITY: RPC URL must be a devnet endpoint. Got: {rpc_url}\n" f"Allowed patterns: {', '.join(ALLOWED_DEVNET_PATTERNS)}\n" "This skill is devnet-only for security. Never use mainnet keys or endpoints." ) ``` Registration accepts and persists an RPC URL returned by the Optionns API: ```bash # Extract RPC URL from API response (Helius endpoint for reliable devnet access) rpc_url=$(echo "$result" | jq -r '.data.rpc_url // .rpc_url // "https://api.devnet.solana.com"' 2>/dev/null) cat > ~/.config/optionns/credentials.json << EOF { "api_key": "$api_key", "wallet_address": "$wallet", "agent_name": "$agent_name", "rpc_url": "$rpc_url" } EOF ``` ### Technical Analysis The validator searches the entire URL string for an allowed substring rather than parsing and comparing the destination hostname. An attacker-controlled URL such as: ```text https://api.devnet.solana.com.attacker.example/rpc ``` contains the ...[truncated 1807 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Open-Ended Python Dependency Constraints Permit Unreviewed Future Releases

Content
View full analysis
=0.21.0 httpx>=0.24.0 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis Both dependencies use lower-bound-only constraints. A fresh installation may therefore resolve any future version that satisfies the minimum version, rather than the specific release reviewed with this skill. No lockfile or package hashes are supplied. This prevents reproducible dependency resolution and leaves installation behavior dependent on the package index state at installation time. The finding does not establish that either named package is currently malicious; it identifies a supply-chain control weakness. ### Attack Path 1. A dependency publisher account, package repository, or release process is compromised, or a future release introduces malicious or unsafe behavior. 2. The compromised release retains a version number greater than the configured minimum. 3. A user runs `pip install -r requirements.txt`. 4. The resolver selects the newer, unreviewed release. 5. Package installation or subsequent import executes the affected package with the privileges of the user running the skill. ### Impact Assessment A malicious dependency release could execute code under the installing user's account and access files available to that account. In this project, that scope may include the Optionns API credential file and the local Solana Devnet keypair under `~/.config/optionns/`. The exact impact depends on the privileges used for installation and execution. Installing inside an isolated, unprivileged virtual environment limits package modification scope, but it does not by itself prevent access to user-readable credential files. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (80)

Credential Access

High
Category
Privilege Escalation
Confidence
71% confidence
Finding

The README states that the skill writes a Solana private key and API credentials to predictable files under ~/.config/optionns/. Even with 600 permissions, plaintext secret storage creates a real exposure path if the local account, agent runtime, backups, logs, or filesystem are compromised; in an agent skill context, persistence of signing keys is more sensitive because the skill can initiate transactions autonomously.

Content

Scanner excerpt · README.md (reported line 72)May include surrounding context.

md
**Files written** (permissions `600`):

- `~/.config/optionns/credentials.json` — API key, wallet address
- `~/.config/optionns/agent_keypair.json` — Solana keypair (private key)

**⚠️ Devnet Only:** Uses mock USDC on Solana Devnet. Do NOT use mainnet wallets or real funds.

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The documentation instructs the skill to store an API key and a Solana keypair with private key material on disk in a predictable location under the user's home directory. Even with 600 permissions, local plaintext credential storage materially increases exposure to credential theft by other local processes, malware, backups, or misconfigured environments, especially because the signer will act on any RPC URL provided.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
>
> **What gets stored locally:**
>
> - `~/.config/optionns/credentials.json` — API key + wallet address (600 perms)
> - `~/.config/optionns/agent_keypair.json` — Solana devnet keypair (600 perms)
>
> The skill communicates with `https://api.optionns.com` (remote service) and Solana Devnet RPC. Treat as untrusted network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 191)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 245)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

md
network endpoints until you verify provenance. Review `scripts/signer.py` and `scripts/optionns.sh` before allowing autonomous operation with credentials.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:422