Trails - pay with any token from any chain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Trails integration helper, but it needs Review because it asks agents to inspect API-key locations and includes copyable high-impact blockchain transaction examples without enough safeguards.

Review this skill before installing. If you use it, do not let the agent print or read API-key values; prefer user confirmation or existence-only checks. Pin skill and npm package versions, use testnets first, require explicit human confirmation before signing or executing transactions, and add authentication, authorization, schema validation, rate limits, recipient/token/chain allowlists, slippage limits, replay protection, and audit logging before deploying any generated backend or DeFi code.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:103

Finding

Mandatory Inspection of Credential-Bearing Files and Environment Variables

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:138

Finding

Forced Use of Unpinned Latest Dependencies

Content

View full analysis

Remediation

View remediation

pnpm add @0xtrails/trails-api@ ``` 2. Commit and enforce a package-manager lockfile. 3. Use package integrity hashes and trusted registries where supported. 4. Pin CLI execution explicitly rather than invoking an unversioned `npx` package: ```bash npx --yes --package=skills@ skills add 0xsequence-demos/trails-skills ``` 5. Disable lifecycle scripts during initial review when feasible, then selectively permit documented scripts. 6. Run dependency provenance, signature, vulnerability, and maintainer-history checks before upgrades. 7. Remove the instruction that generated commands must always use the latest version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: docs/API_RECIPES.md:620

Finding

Unauthenticated Backend Routes Proxy Privileged Transaction Operations

Content

View full analysis

{ try { const quote = await trails.quoteIntent(req.body); res.json(quote); } catch (error) { res.status(400).json({ error: error instanceof Error ? error.message : 'Unknown error' }); } }); app.post('/api/execute', async (req, res) => { try { const { quoteId, signature } = req.body; const intent = await trails.commitIntent({ quoteId }); await trails.executeIntent({ intentId: intent.intentId, signature }); const receipt = await trails.waitIntentReceipt({ intentId: intent.intentId, timeout: 120000, }); res.json(receipt); } catch (error) { res.status(400).json({ error: error instanceof Error ? error.message : 'Unknown error' }); } }); app.listen(3000, () => { console.log('Server running on port 3000'); }); ``` The snippet version also exposes intent lookup: ```typescript app.get('/api/intent/:id', async (req, res) => { try { const intent = await trails.getIntent({ intentId: req.params.id }); res.json(intent); } catch (error) { res .status(404) .json({ error: error instanceof Error ? error.message : 'Not found' }); } }); ``` ### Technical Analysis These ready-to-copy Express routes expose operations performed with the server's `TRAILS_API_KEY` without authenticating callers or authorizing requested resources. The quote endpoint forwards the complete attacker-controlled request body to `quoteIntent`. The execution endpoint a ...[truncated 2091 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/TROUBLESHOOTING.md:94

Finding

Troubleshooting Guidance Prints and Discloses API-Key Material

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: docs/HEADLESS_SDK_RECIPES.md:58

Finding

Automatic Transaction Execution Is Presented Behind Inert Action Buttons

Content

View full analysis

{isPending ? 'Processing...' : isSuccess ? 'Sent!' : 'Send'} {isSuccess &&

Success! Intent ID: {quote?.intentId}

} {isError &&

Error: {error?.message}

} ); } ``` ``` The rendered `Send` button has no `onClick` handler, while the documentation explicitly states that the hook executes automatically. ### Technical Analysis The example makes the visible action button appear to control transaction initiation, but the button is inert. Instead, the transaction hook activates as soon as its parameters are considered ready. In dynamic swap and deposit examples, completing the final input can make the hook parameters non-null and start the flow without a deliberate click on the displayed `Swap` or `Deposit` button. Although wallet software may still request a signature, the application has ...[truncated 1463 chars]

Remediation

View remediation

(null); const result = useQuote(confirmedParams); setConfirmedParams({ ...draftParams })} > Review and continue ``` 3. Display a final confirmation view containing the source and destination chains, tokens, amount, recipient, calldata target, fees, slippage, and expiration. 4. Bind the execution request to an immutable snapshot of the reviewed parameters. 5. Invalidate confirmation whenever any transaction parameter changes. 6. Clearly distinguish quote generation, wallet signing, submission, and completion states. 7. Do not render an action button unless it is the actual trigger for the represented action. 8. Add tests confirming that editing form fields cannot initiate execution or signing prompts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: snippets/calldata-viem.ts:162

Finding

Liquidity Calldata Defaults to Zero Minimum Output

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

The skill explicitly tells the agent to search .env files, environment variables, and configuration for API keys before doing anything else. In an agent context, this is credential discovery behavior that can expose secrets unrelated to the current task, and the broad instruction lacks minimization, consent, and clear boundaries on what may be read or revealed.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

1. Create an account (or sign in) 2. Generate your API key

   Once you have your key, add it to your .env file:

   text

   
   Then show them the environment variable format:
   

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 400)May include surrounding context.

3. Generate a new API key 4. Copy the key

   Once you have your key, add it to your .env file and let me know!

   text

4. Wait for confirmation that they have the key before proceeding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The batch settlement example iterates over recipients and executes treasury-funded cross-chain transfers in a loop, but it lacks a clear warning that it can perform repeated real payouts. In practice, this is especially risky for backend automation because a configuration error, malformed input, or unsafe agent behavior could rapidly drain treasury funds across many destinations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 113)May include surrounding context.

3. For Next.js, ensure correct prefix:

text

# .env.local
TRAILS_API_KEY=sk_...           # Server-side only
NEXT_PUBLIC_TRAILS_API_KEY=pk_... # Client-side (exposed)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx skills add 0xsequence-demos/trails-skills without pinning a specific package/version, which allows whatever package version is current at execution time to run code on the user's machine. In the context of an agent skill installer, this increases supply-chain risk because a compromised package, hijacked dependency, or malicious future release could be fetched and executed implicitly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

md

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

md

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation triggers include broad terms like swap, payments, and cross-chain, which can cause the skill to auto-activate in contexts where the user did not intend to invoke it. In an AI agent environment, overbroad trigger matching can expand the skill's influence over prompts and code generation, increasing the chance of unintended actions or leakage of contextual project data to the skill workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This repeats the same unpinned npx skills add installation pattern later in the README, again encouraging execution of a mutable remote package. Repetition increases exposure because users are more likely to copy-paste the command without reviewing provenance or version constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The installation verification section reinforces vague trigger phrases such as bridge, swap, and cross-chain without defining strict activation conditions. This makes accidental invocation more likely and is more dangerous in this skill because it is designed to steer implementation choices, environment setup, and API usage once activated.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to inspect environment files/variables and to access external documentation and API endpoints, but it declares no explicit tool scope or allowed-tools boundary. In an agent system, missing capability scoping can permit unnecessary access to secrets and network resources, increasing the blast radius if the skill is invoked unexpectedly or manipulated by prompt/context injection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Broad cross-chain and DeFi terms create weak activation boundaries for a skill with sensitive behaviors. This makes it easier for unrelated requests to invoke the skill and inherit its instructions to probe the environment and use network resources.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These triggers are ambiguous and common across Web3 and general product discussions, making accidental activation likely. Because the skill can lead the agent to inspect local configuration and suggest credential setup flows, unintended invocation materially increases exposure risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases in this range include generic payment and token-related language that is likely to match many normal developer conversations. Overbroad activation can cause the skill to run outside its intended context, which is especially risky here because the skill encourages env inspection and outbound network usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example walks through quote, commit, execute, and completion of a cross-chain transfer, but it does not explicitly warn that these steps can trigger real token movement and other irreversible financial effects once a valid signature is provided. In an AI-agent and automation context, omission of such warnings increases the risk that integrators treat the sample as a harmless demo and wire it into autonomous flows without adequate human confirmation or spending limits.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/API_RECIPES.md (reported line 242)May include surrounding context.

md

}

def quote_intent(params):
    response = requests.post(f"{TRAILS_API_URL}/quote", json=params, headers=headers)
    response.raise_for_status()
    return response.json()

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/API_RECIPES.md (reported line 247)May include surrounding context.

md

return response.json()

def commit_intent(quote_id):
    response = requests.post(f"{TRAILS_API_URL}/intent/commit", 
                            json={"quoteId": quote_id}, headers=headers)
    response.raise_for_status()
    return response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide explicitly promotes executing arbitrary destination-chain contract calls after bridging/swapping tokens, but the nearby text does not clearly warn that users may irreversibly transfer assets into untrusted or incompatible contracts. In a cross-chain payments/DeFi skill, this is more dangerous because mistakes are harder to recover from and destination execution can compound bridge, swap, and contract-call risk into a single irreversible flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The liquidity example sets minLpTokens to 0 and comments that this means no slippage protection, which normalizes an unsafe default without an adjacent warning about sandwiching, severe price movement, or value loss. In a DeFi/cross-chain context, this is particularly risky because users may face compounded execution uncertainty and receive materially worse outcomes by the time the destination call executes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation shows useQuote examples that execute automatically when parameters are present, including real recipient addresses, token addresses, and amounts, but does not prominently warn that these snippets can initiate actual swaps or transfers once integrated. In a cross-chain payments skill, this is particularly risky because developers may copy-paste examples into production UIs and unintentionally create flows that trigger wallet signing and fund movement without an explicit user-initiated action boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation explicitly instructs users to place a client-side API key in a NEXT_PUBLIC_ environment variable, which makes the key readable by any browser user. Even if the platform intends this key to be public, the docs provide no warning about exposure, scope restrictions, or abuse controls, which can lead integrators to treat it like a secret and rely on it for trust or quota protection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown instructs users to place the API key in NEXT_PUBLIC_TRAILS_API_KEY, which in typical Next.js usage makes the value available in client-side bundles. Because this affects credential exposure and privacy/security posture, the doc should explicitly warn readers that the key is public-scoped and must not be a secret key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown describes pay, swap, fund, and post-bridge calldata execution flows that can move assets or trigger on-chain contract actions, but it does not include cautionary language about reviewing chain, recipient, token, amount, and transaction irreversibility. For markdown files, user-facing warnings are expected when behaviors may affect user funds or system integrity.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: snippets/node-api.ts:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: snippets/react-widget.tsx:29