Trails - pay with any token from any chain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent Trails integration helper, but it needs Review because it asks agents to inspect API-key locations and includes copyable high-impact blockchain transaction examples without enough safeguards.

Review this skill before installing. If you use it, do not let the agent print or read API-key values; prefer user confirmation or existence-only checks. Pin skill and npm package versions, use testnets first, require explicit human confirmation before signing or executing transactions, and add authentication, authorization, schema validation, rate limits, recipient/token/chain allowlists, slippage limits, replay protection, and audit logging before deploying any generated backend or DeFi code.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:103
• Finding: Mandatory Inspection of Credential-Bearing Files and Environment Variables<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:103-109` **Vulnerability Type**: Sensitive credential access beyond minimum required privileges **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 1: Check for Trails API Key **BEFORE generating any integration code**, check if the user has a Trails API key: 1. **Search for API key** in: - `.env` files → `TRAILS_API_KEY` or `NEXT_PUBLIC_TRAILS_API_KEY` - Environment variables in the project - Configuration files ``` ### Technical Analysis The Skill requires the agent to inspect `.env` files, project environment variables, and configuration files before generating integration code. These locations commonly contain credentials unrelated to Trails in addition to the named Trails variables. Even if the intended search is limited to `TRAILS_API_KEY` and `NEXT_PUBLIC_TRAILS_API_KEY`, retrieving their values places secret material into the agent's tool output and working context. The values may subsequently appear in transcripts, model-provider telemetry, terminal logs, debugging output, or accidentally generated responses. Reading credential values is not necessary to determine whether a project is ready for integration. The Skill can ask the user whether a key is configured or perform an existence-only check that never returns the value. ### Attack Path 1. The Skill activates for a Trails-related request. 2. Its mandatory workflow directs the agent to inspect `.env`, runtime environment, and configuration files. 3. A tool invocation reads or returns an actual API-key value. 4. The credential enters the agent session, tool logs, or transcript. 5. A later diagnostic, generated configuration, support interaction, or accidental output discloses the credential. 6. Anyone obtaining the key may access Trails APIs within the key's assigned privileges and quota. ### Impact Assessment Potential exposure includes Trails API credentials and, if the search is implemented too broadly ...[truncated 319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace mandatory credential searches with an explicit question asking whether the required variable is configured. 2. If automated checking is needed, perform an existence-only check and never return the value: ```bash if [ -n "${TRAILS_API_KEY+x}" ]; then echo "TRAILS_API_KEY is configured" else echo "TRAILS_API_KEY is not configured" fi ``` 3. Require explicit user consent before inspecting any `.env` or configuration file. 4. Restrict searches to exact variable names and prevent surrounding file contents from being returned. 5. Redact values at the tool boundary before they enter agent context. 6. Document that API keys must never be included in prompts, generated code, logs, or support messages. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:138
• Finding: Forced Use of Unpinned Latest Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:138-141` **Additional Locations**: `SKILL.md:186`, `SKILL.md:226`, `SKILL.md:272`, `README.md:10`, `README.md:130-133` **Vulnerability Type**: Unpinned dependency and remote package execution risk **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 4: Generate Code Output: - Installation commands (always use latest version: `@0xtrails/trails` or `@0xtrails/trails-api` without version pins) - Provider wiring (if applicable) - Integration code snippet - Environment variable usage (referencing the key they just set up) ``` Representative installation commands include: ```bash pnpm add @0xtrails/trails pnpm add @0xtrails/trails-api npx skills add 0xsequence-demos/trails-skills ``` ### Technical Analysis The governing instruction explicitly requires the latest package version and prohibits version pinning. Consequently, the code installed when a user follows the Skill can change independently of the audited Skill contents. Package managers may execute package lifecycle scripts during installation. Similarly, `npx` can download and execute a package that is not already installed locally. A compromised maintainer account, malicious new release, registry compromise, or compromised transitive dependency could therefore lead to arbitrary code execution under the developer's account. The repository does not provide a lockfile, integrity hashes, an approved-version policy, or instructions to disable lifecycle scripts. ### Attack Path 1. A developer or agent follows the Skill's mandatory unpinned installation command. 2. The package manager resolves the newest available package and transitive dependencies. 3. An attacker has compromised a package release, maintainer account, or dependency in the resolved graph. 4. The package manager downloads the attacker-controlled version. 5. A lifecycle script, build hook, imported module, or `npx` entry point executes. 6. The malicious package gains ...[truncated 623 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin dependencies to exact reviewed versions: ```bash pnpm add @0xtrails/trails@<reviewed-version> pnpm add @0xtrails/trails-api@<reviewed-version> ``` 2. Commit and enforce a package-manager lockfile. 3. Use package integrity hashes and trusted registries where supported. 4. Pin CLI execution explicitly rather than invoking an unversioned `npx` package: ```bash npx --yes --package=skills@<reviewed-version> skills add 0xsequence-demos/trails-skills ``` 5. Disable lifecycle scripts during initial review when feasible, then selectively permit documented scripts. 6. Run dependency provenance, signature, vulnerability, and maintainer-history checks before upgrades. 7. Remove the instruction that generated commands must always use the latest version. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: docs/API_RECIPES.md:620
• Finding: Unauthenticated Backend Routes Proxy Privileged Transaction Operations<![CDATA[ ## Vulnerability Details **File Location**: `docs/API_RECIPES.md:620-650` **Additional Location**: `snippets/node-api.ts:465-506` **Vulnerability Type**: Missing authentication, authorization, input validation, and replay protection **Risk Level**: High ### Vulnerable Code ```typescript import express from 'express'; import { TrailsAPI } from '@0xtrails/trails-api'; const app = express(); app.use(express.json()); const trails = new TrailsAPI({ apiKey: process.env.TRAILS_API_KEY! }); app.post('/api/quote', async (req, res) => { try { const quote = await trails.quoteIntent(req.body); res.json(quote); } catch (error) { res.status(400).json({ error: error instanceof Error ? error.message : 'Unknown error' }); } }); app.post('/api/execute', async (req, res) => { try { const { quoteId, signature } = req.body; const intent = await trails.commitIntent({ quoteId }); await trails.executeIntent({ intentId: intent.intentId, signature }); const receipt = await trails.waitIntentReceipt({ intentId: intent.intentId, timeout: 120000, }); res.json(receipt); } catch (error) { res.status(400).json({ error: error instanceof Error ? error.message : 'Unknown error' }); } }); app.listen(3000, () => { console.log('Server running on port 3000'); }); ``` The snippet version also exposes intent lookup: ```typescript app.get('/api/intent/:id', async (req, res) => { try { const intent = await trails.getIntent({ intentId: req.params.id }); res.json(intent); } catch (error) { res .status(404) .json({ error: error instanceof Error ? error.message : 'Not found' }); } }); ``` ### Technical Analysis These ready-to-copy Express routes expose operations performed with the server's `TRAILS_API_KEY` without authenticating callers or authorizing requested resources. The quote endpoint forwards the complete attacker-controlled request body to `quoteIntent`. The execution endpoint a ...[truncated 2091 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require authenticated sessions or service credentials for every route. 2. Authorize each operation against the authenticated principal and expected wallet address. 3. Define strict request schemas and reject unknown fields. 4. Enforce allowlists and business limits for chains, tokens, recipients, calldata targets, amounts, and slippage. 5. Bind signatures to the exact intent, authenticated wallet, chain, nonce, expiration time, and application domain. 6. Store consumed nonces and intent IDs to prevent replay. 7. Verify that a submitted quote was created by the same authenticated principal before committing it. 8. Add per-user and per-IP rate limits, request-size limits, and bounded upstream timeouts. 9. Move receipt polling to a background job and return a job identifier instead of holding an HTTP request open. 10. Protect intent lookups with ownership checks and return only necessary fields. 11. Add structured security audit logs without recording API keys or full signatures. 12. Return sanitized errors rather than raw upstream messages. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: docs/TROUBLESHOOTING.md:94
• Finding: Troubleshooting Guidance Prints and Discloses API-Key Material<![CDATA[ ## Vulnerability Details **File Location**: `docs/TROUBLESHOOTING.md:94-100` **Additional Location**: `docs/TROUBLESHOOTING.md:403-410` **Vulnerability Type**: Plaintext credential exposure through diagnostics and support workflows **Risk Level**: Medium ### Vulnerable Code ```markdown 1. Verify the key is set: ```bash echo $TRAILS_API_KEY # or for Next.js client echo $NEXT_PUBLIC_TRAILS_API_KEY ``` ``` The support guidance further states: ```markdown 3. **Collect debug info**: - API key (first 8 chars only) - Chain IDs and token addresses - Error message and stack trace - Transaction hash (if available) 4. **Contact support** with the above information ``` ### Technical Analysis The `echo` commands print complete API-key values to standard output. Terminal output is often captured in shell logs, CI logs, remote support sessions, screen recordings, agent tool responses, or copied troubleshooting transcripts. The instruction to collect and send the first eight key characters also creates unnecessary credential disclosure. Even a prefix can help correlate credentials, identify key formats, or strengthen social-engineering attempts. Support personnel generally need a non-secret account identifier or locally generated fingerprint rather than any portion of the credential itself. ### Attack Path 1. A user encounters an authentication problem and follows the troubleshooting guide. 2. The user executes `echo $TRAILS_API_KEY`. 3. The complete secret appears in terminal output. 4. The terminal is recorded, shared, captured by an AI agent, or copied into a support ticket. 5. The user additionally includes the first eight characters in a support message. 6. An unauthorized party obtains enough credential material to use the key directly or facilitate further credential-targeting attacks. ### Impact Assessment A fully disclosed server-side API key can permit any Trails API operation granted to that key and consume its quota. Exposure in ...[truncated 296 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace secret-printing commands with existence-only diagnostics: ```bash if [ -n "${TRAILS_API_KEY:-}" ]; then echo "TRAILS_API_KEY is configured" else echo "TRAILS_API_KEY is missing" fi ``` 2. Never ask users to provide any API-key substring to support. 3. Use a non-secret key identifier supplied by the dashboard or a one-way local fingerprint if correlation is necessary. 4. Warn users to redact environment dumps, request headers, screenshots, and shell transcripts. 5. Ensure application logs remove `Authorization`, API-key, cookie, signature, and webhook-secret fields. 6. Recommend immediate key rotation if a key has been printed into shared or persistent output. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: docs/HEADLESS_SDK_RECIPES.md:58
• Finding: Automatic Transaction Execution Is Presented Behind Inert Action Buttons<![CDATA[ ## Vulnerability Details **File Location**: `docs/HEADLESS_SDK_RECIPES.md:58-76` **Additional Locations**: `docs/HEADLESS_SDK_RECIPES.md:228-259`, `docs/HEADLESS_SDK_RECIPES.md:326-353`, `docs/HEADLESS_SDK_RECIPES.md:390-402`, `snippets/react-headless.tsx:57-71`, `snippets/react-headless.tsx:151-230`, `snippets/react-headless.tsx:267-302`, `snippets/react-headless.tsx:341-355`, `docs/TRAILS_OVERVIEW.md:91-98`, `docs/INTEGRATION_DECISION_TREE.md:112` **Vulnerability Type**: Misleading transaction UX and missing explicit execution control **Risk Level**: High ### Vulnerable Code ```markdown ## Core Hook: useQuote The primary hook for executing Trails intents. Executes automatically when ready. ```tsx import { useQuote } from '@0xtrails/trails'; function SendButton() { const { quote, isPending, isSuccess, isError, error } = useQuote({ destinationChainId: 8453, destinationTokenAddress: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913', destinationAmount: '10000000', // 10 USDC destinationRecipient: '0xRecipientAddress', }); return ( <div> <button disabled={isPending || isSuccess}> {isPending ? 'Processing...' : isSuccess ? 'Sent!' : 'Send'} </button> {isSuccess && <p>Success! Intent ID: {quote?.intentId}</p>} {isError && <p>Error: {error?.message}</p>} </div> ); } ``` ``` The rendered `Send` button has no `onClick` handler, while the documentation explicitly states that the hook executes automatically. ### Technical Analysis The example makes the visible action button appear to control transaction initiation, but the button is inert. Instead, the transaction hook activates as soon as its parameters are considered ready. In dynamic swap and deposit examples, completing the final input can make the hook parameters non-null and start the flow without a deliberate click on the displayed `Swap` or `Deposit` button. Although wallet software may still request a signature, the application has ...[truncated 1463 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Separate quote retrieval from transaction execution. 2. Require an explicit `onClick` action to enter execution state: ```tsx const [confirmedParams, setConfirmedParams] = useState<QuoteParams | null>(null); const result = useQuote(confirmedParams); <button type="button" disabled={!draftIsValid || result.isPending} onClick={() => setConfirmedParams({ ...draftParams })} > Review and continue </button> ``` 3. Display a final confirmation view containing the source and destination chains, tokens, amount, recipient, calldata target, fees, slippage, and expiration. 4. Bind the execution request to an immutable snapshot of the reviewed parameters. 5. Invalidate confirmation whenever any transaction parameter changes. 6. Clearly distinguish quote generation, wallet signing, submission, and completion states. 7. Do not render an action button unless it is the actual trigger for the represented action. 8. Add tests confirming that editing form fields cannot initiate execution or signing prompts. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: snippets/calldata-viem.ts:162
• Finding: Liquidity Calldata Defaults to Zero Minimum Output<![CDATA[ ## Vulnerability Details **File Location**: `snippets/calldata-viem.ts:162-172` **Additional Location**: `docs/CALLDATA_GUIDE.md:176-180` **Vulnerability Type**: Missing slippage protection in financial transaction construction **Risk Level**: High ### Vulnerable Code ```typescript export function encodeAddLiquidity( minLpTokens: bigint = BigInt(0), deadlineSeconds: number = 3600 ): `0x${string}` { const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineSeconds); return encodeFunctionData({ abi: lpAbi, functionName: 'addLiquidity', args: [PLACEHOLDER_AMOUNT, minLpTokens, deadline], }); } ``` The documentation also demonstrates the unsafe value directly: ```typescript const calldata = encodeFunctionData({ abi: lpAbi, functionName: 'addLiquidity', args: [PLACEHOLDER, BigInt(0), deadline], // 0 minLpTokens for no slippage protection }); ``` ### Technical Analysis The reusable helper defaults `minLpTokens` to zero. This means the transaction accepts any amount of liquidity-provider tokens, including an amount far below the expected quote. Minimum-output parameters are a core protection against market movement, manipulated pool states, front-running, and sandwich attacks. A zero minimum disables that protection entirely. The unsafe value is not restricted to a test-only context and is presented as a copyable integration pattern. The default also conflicts with the guide's later general recommendation to consider minimum-amount checks. ### Attack Path 1. A developer copies `encodeAddLiquidity()` and omits the optional `minLpTokens` argument. 2. The helper encodes a minimum output of zero. 3. The transaction is submitted to a public execution path. 4. Market movement, low liquidity, or an attacker manipulating transaction ordering changes the effective exchange ratio. 5. The liquidity operation returns substantially fewer LP tokens than expected. 6. Because the minimum is zero, the transaction succeeds instead ...[truncated 520 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the zero default and require an explicit minimum: ```typescript export function encodeAddLiquidity( minLpTokens: bigint, deadlineSeconds = 300 ): `0x${string}` { if (minLpTokens <= 0n) { throw new Error('minLpTokens must be greater than zero'); } const deadline = BigInt(Math.floor(Date.now() / 1000) + deadlineSeconds); return encodeFunctionData({ abi: lpAbi, functionName: 'addLiquidity', args: [PLACEHOLDER_AMOUNT, minLpTokens, deadline], }); } ``` 2. Calculate the minimum from a fresh expected-output quote and an application-defined maximum slippage tolerance. 3. Reject stale quotes and expired deadlines. 4. Use shorter deadlines unless the cross-chain execution model requires a longer, explicitly justified period. 5. Display the expected and minimum output to the user before signature. 6. If a zero minimum is needed for testing, isolate it in clearly labeled test-only code that cannot be used in production builds. 7. Add unit tests asserting that zero or negative minimum outputs are rejected. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (29)

Credential Access

High

• Category: Privilege Escalation

Content

1. Create an account (or sign in)
   2. Generate your API key
   
   Once you have your key, add it to your .env file:
   ```
   
   Then show them the environment variable format:

• Confidence: 93% confidence
• Finding: The skill explicitly tells the agent to search `.env` files, environment variables, and configuration for API keys before doing anything else. In an agent context, this is credential discovery behavior that can expose secrets unrelated to the current task, and the broad instruction lacks minimization, consent, and clear boundaries on what may be read or revealed.

Credential Access

High

• Category: Privilege Escalation

Content

3. Generate a new API key
   4. Copy the key
   
   Once you have your key, add it to your .env file and let me know!
   ```

2. **Wait for confirmation** that they have the key before proceeding.

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The batch settlement example iterates over recipients and executes treasury-funded cross-chain transfers in a loop, but it lacks a clear warning that it can perform repeated real payouts. In practice, this is especially risky for backend automation because a configuration error, malformed input, or unsafe agent behavior could rapidly drain treasury funds across many destinations.

Credential Access

High

• Category: Privilege Escalation

Content

3. For Next.js, ensure correct prefix:
```
# .env.local
TRAILS_API_KEY=sk_...           # Server-side only
NEXT_PUBLIC_TRAILS_API_KEY=pk_... # Client-side (exposed)
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The README instructs users to run `npx skills add 0xsequence-demos/trails-skills` without pinning a specific package/version, which allows whatever package version is current at execution time to run code on the user's machine. In the context of an agent skill installer, this increases supply-chain risk because a compromised package, hijacked dependency, or malicious future release could be fetched and executed implicitly.

External Transmission

Medium

• Category: Data Exfiltration

Content

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const receipt = await trails.executeIntent({ intentId });

// Or Raw Fetch (Universal)
const quote = await fetch('https://api.trails.build/quote', {
  method: 'POST',
  headers: { 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ ...params })

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation triggers include broad terms like `swap`, `payments`, and `cross-chain`, which can cause the skill to auto-activate in contexts where the user did not intend to invoke it. In an AI agent environment, overbroad trigger matching can expand the skill's influence over prompts and code generation, increasing the chance of unintended actions or leakage of contextual project data to the skill workflow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: This repeats the same unpinned `npx skills add` installation pattern later in the README, again encouraging execution of a mutable remote package. Repetition increases exposure because users are more likely to copy-paste the command without reviewing provenance or version constraints.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The installation verification section reinforces vague trigger phrases such as `bridge`, `swap`, and `cross-chain` without defining strict activation conditions. This makes accidental invocation more likely and is more dangerous in this skill because it is designed to steer implementation choices, environment setup, and API usage once activated.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to inspect environment files/variables and to access external documentation and API endpoints, but it declares no explicit tool scope or allowed-tools boundary. In an agent system, missing capability scoping can permit unnecessary access to secrets and network resources, increasing the blast radius if the skill is invoked unexpectedly or manipulated by prompt/context injection.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Broad cross-chain and DeFi terms create weak activation boundaries for a skill with sensitive behaviors. This makes it easier for unrelated requests to invoke the skill and inherit its instructions to probe the environment and use network resources.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: These triggers are ambiguous and common across Web3 and general product discussions, making accidental activation likely. Because the skill can lead the agent to inspect local configuration and suggest credential setup flows, unintended invocation materially increases exposure risk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases in this range include generic payment and token-related language that is likely to match many normal developer conversations. Overbroad activation can cause the skill to run outside its intended context, which is especially risky here because the skill encourages env inspection and outbound network usage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example walks through quote, commit, execute, and completion of a cross-chain transfer, but it does not explicitly warn that these steps can trigger real token movement and other irreversible financial effects once a valid signature is provided. In an AI-agent and automation context, omission of such warnings increases the risk that integrators treat the sample as a harmless demo and wire it into autonomous flows without adequate human confirmation or spending limits.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

def quote_intent(params):
    response = requests.post(f"{TRAILS_API_URL}/quote", json=params, headers=headers)
    response.raise_for_status()
    return response.json()

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

return response.json()

def commit_intent(quote_id):
    response = requests.post(f"{TRAILS_API_URL}/intent/commit", 
                            json={"quoteId": quote_id}, headers=headers)
    response.raise_for_status()
    return response.json()

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide explicitly promotes executing arbitrary destination-chain contract calls after bridging/swapping tokens, but the nearby text does not clearly warn that users may irreversibly transfer assets into untrusted or incompatible contracts. In a cross-chain payments/DeFi skill, this is more dangerous because mistakes are harder to recover from and destination execution can compound bridge, swap, and contract-call risk into a single irreversible flow.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The liquidity example sets minLpTokens to 0 and comments that this means no slippage protection, which normalizes an unsafe default without an adjacent warning about sandwiching, severe price movement, or value loss. In a DeFi/cross-chain context, this is particularly risky because users may face compounded execution uncertainty and receive materially worse outcomes by the time the destination call executes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation shows `useQuote` examples that execute automatically when parameters are present, including real recipient addresses, token addresses, and amounts, but does not prominently warn that these snippets can initiate actual swaps or transfers once integrated. In a cross-chain payments skill, this is particularly risky because developers may copy-paste examples into production UIs and unintentionally create flows that trigger wallet signing and fund movement without an explicit user-initiated action boundary.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation explicitly instructs users to place a client-side API key in a `NEXT_PUBLIC_` environment variable, which makes the key readable by any browser user. Even if the platform intends this key to be public, the docs provide no warning about exposure, scope restrictions, or abuse controls, which can lead integrators to treat it like a secret and rely on it for trust or quota protection.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown instructs users to place the API key in `NEXT_PUBLIC_TRAILS_API_KEY`, which in typical Next.js usage makes the value available in client-side bundles. Because this affects credential exposure and privacy/security posture, the doc should explicitly warn readers that the key is public-scoped and must not be a secret key.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown describes pay, swap, fund, and post-bridge calldata execution flows that can move assets or trigger on-chain contract actions, but it does not include cautionary language about reviewing chain, recipient, token, amount, and transaction irreversibility. For markdown files, user-facing warnings are expected when behaviors may affect user funds or system integrity.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: snippets/node-api.ts:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: snippets/react-widget.tsx:29