ClawDex Trading

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:46 PM UTC
• Version: 1.0.0

Overview

This Solana trading skill is purpose-aligned, but it needs review because it installs a mutable global CLI and gives it wallet/API access plus non-interactive swap authority.

Review this before installing. Use a pinned, verified ClawDex version, prefer an isolated low-value wallet or hardware/approval-based signer, simulate first, and only allow a live swap after confirming the exact tokens, amount, slippage, route, destination, and fees.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17

Finding

Unpinned Global Installation of a Wallet-Enabled Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: High

Vulnerable Code

bash

which clawdex || npm install -g clawdex@latest

The installed CLI is subsequently instructed to access sensitive credentials and wallet material:

bash

clawdex onboarding \
  --jupiter-api-key "$JUPITER_API_KEY" \
  --rpc "${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" \
  --wallet ~/.config/solana/id.json \
  --json

It is also authorized to execute real token swaps:

bash

clawdex swap --in SOL --out USDC --amount 0.01 --yes --json

Technical Analysis

The skill instructs the agent to install the mutable clawdex@latest package globally. It does not pin an audited version, verify an integrity hash or package signature, use a lockfile, or validate package provenance.

Because the latest tag can resolve to different package contents over time, the code executed during installation and subsequent CLI operations may differ from what was originally reviewed. Global npm installation may also execute package lifecycle scripts and places the package in a broadly available system-level tool location.

The risk is amplified because the installed CLI is later provided with a Jupiter API key and the path to a Solana wallet key file. It is also invoked with --yes to execute real transactions. A compromised upstream release or dependency could read sensitive files, transmit credentials, substitute transaction parameters, or alter transaction-signing behavior.

Attack Path

1. An attacker compromises the clawdex npm package, one of its transitive dependencies, or the package publishing account.
2. The attacker publishes a malicious release and assigns it to the mutable latest tag.
3. On a system where clawdex is absent, the skill runs:

   bash

   npm install -g clawdex@latest
   

4. Malicious package installation hooks or C ...[truncated 1258 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawdex@latest with an exact, audited version:

   bash

   npm install -g clawdex@X.Y.Z
   

2. Verify the package's official publisher, registry origin, release provenance, and cryptographic integrity before installation.
3. Prefer a project-local, lockfile-controlled installation rather than a global installation. Commit and review the lockfile, including transitive dependency changes.
4. Disable npm lifecycle scripts during installation when the package supports operation without them:

   bash

   npm install --ignore-scripts
   

5. Run the CLI in a restricted environment with minimal filesystem and network permissions.
6. Avoid exposing a raw private-key file to the CLI. Prefer a hardware wallet, isolated signing service, or signer interface that requires explicit approval and does not reveal private-key material.
7. Require explicit user confirmation for the exact input mint, output mint, amount, slippage, destination accounts, and quoted minimum output before broadcasting each real swap.
8. Independently validate the serialized transaction before signing, including all program IDs, account addresses, token mints, transfer amounts, fees, and destination accounts.
9. Use a dedicated low-value trading wallet to limit the blast radius of dependency compromise.
10. Document and enforce a package-update review process rather than automatically accepting changes through the latest tag.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill gives a concrete command for executing a live swap with --yes, but it does not clearly state that this broadcasts an irreversible on-chain transaction that can spend the user's assets and incur fees. In an agent setting, this omission is dangerous because the command is framed as a normal workflow step, which can reduce friction for high-impact financial actions without explicit user-risk acknowledgement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.