Trends

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent guide for a crypto wallet and trading CLI, but it needs review because it allows confirmation bypasses for financial actions and includes a risky wallet overwrite workflow.

Install only if you are comfortable with a wallet-enabled crypto CLI from an unpinned global npm package. Use a low-value or dedicated wallet, avoid session-level or skip-confirmation modes, verify all quotes and transaction parameters before running writes, and do not use wallet init --force unless the old keypair is backed up and you understand that overwriting it can permanently remove access to assets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: references/install-and-setup.md:13
• Finding: Unpinned Global Installation of a Wallet-Enabled Financial CLI<![CDATA[ ## Vulnerability Details **File Location**: `references/install-and-setup.md:13-22` **Vulnerability Type**: Supply-chain exposure through an unpinned third-party package **Risk Level**: High ### Vulnerable Code Snippet ```markdown ## Global install lifecycle Install: ```bash npm install -g @trends-fun/trends-skill-tool ``` Upgrade: ```bash npm update -g @trends-fun/trends-skill-tool ``` ``` ### Technical Analysis The installation instructions resolve and globally install the currently published version of `@trends-fun/trends-skill-tool` rather than a reviewed, immutable version. No exact version, package integrity hash, lockfile, publisher verification procedure, or reproducible-build validation is specified. A global npm installation may execute package lifecycle scripts with the privileges of the user running npm. The installed CLI is subsequently intended to interact with Solana wallet files, RPC endpoints, token creation, trading, and reward claims. Consequently, compromise of the npm package, its publisher account, or one of its transitive dependencies could introduce code that runs before the user has an opportunity to inspect it. The audit artifact contains only documentation and evaluations; it does not contain the npm package implementation or dependency metadata. The safety of the externally installed package therefore could not be independently verified in this audit. ### Attack Path 1. An attacker compromises the package publisher account, npm package, or a transitive dependency. 2. The attacker publishes a malicious release under the legitimate package name. 3. A user follows the documented `npm install -g` or `npm update -g` command. 4. npm resolves the mutable current release and may execute malicious lifecycle scripts during installation. 5. The malicious code executes with the installing user's privileges. 6. It may inspect user-accessible files and configuration, interfere with later CLI operations, alter transaction para ...[truncated 979 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation to a reviewed exact version, for example: ```bash npm install -g @trends-fun/trends-skill-tool@X.Y.Z ``` 2. Publish and document the expected npm integrity value, package digest, and verified publisher identity. 3. Prefer a lockfile-backed local installation or another reproducible deployment mechanism over resolving mutable global dependencies. 4. Document a release-verification process covering: - Package provenance. - Signed release artifacts. - Dependency changes. - Lifecycle scripts. - Published package contents. 5. Test upgrades in an isolated environment before allowing the new version to access a production wallet. 6. Run the CLI under a dedicated, least-privileged operating-system account and use a low-value wallet where feasible. 7. Avoid elevated npm installation privileges. If global installation is unavoidable, configure a user-owned npm prefix rather than using administrative execution. 8. Provide a rollback procedure pinned to the last reviewed version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/install-and-setup.md:38
• Finding: Destructive Wallet Keypair Overwrite Is Treated as a Non-Gated Routine Operation<![CDATA[ ## Vulnerability Details **File Location**: `references/install-and-setup.md:38-56` **Additional Locations**: `SKILL.md:56-66`, `references/error-playbook.md:23` **Vulnerability Type**: Unsafe destructive wallet-management workflow **Risk Level**: Medium ### Vulnerable Code Snippets `references/install-and-setup.md:38-56`: ```markdown ## Wallet bootstrap Initialize wallet: ```bash trends-skill-tool wallet init ``` Initialize with custom path: ```bash trends-skill-tool wallet init --path ~/.config/solana/id.json ``` Force overwrite when key file exists: ```bash trends-skill-tool wallet init --force ``` ``` `SKILL.md:56-66` classifies wallet initialization as non-gated: ```markdown Non-gated commands (normal flow): - `trends-skill-tool balance` - `trends-skill-tool holdings` - `trends-skill-tool created` - `trends-skill-tool transactions` - `trends-skill-tool quote buy` - `trends-skill-tool quote sell` - `trends-skill-tool reward status` - `trends-skill-tool wallet init` ``` `references/error-playbook.md:23` recommends forced replacement as the immediate response to an existing target: ```markdown | `Target file already exists: <path>, use --force to overwrite` | `wallet init` target exists and overwrite flag missing | Re-run with `--force` if overwrite is intended | `trends-skill-tool wallet init --force` then `trends-skill-tool wallet address` | ``` ### Technical Analysis The documented default keypair path is `~/.config/solana/id.json`, a path commonly used by Solana tooling. The workflow exposes `wallet init --force` as the direct response when the target already exists while classifying `wallet init` as a non-gated command. The documentation does not require the assistant to: - Display and record the existing wallet's public address before replacement. - Explain that replacement can permanently sever access to assets controlled by the old keypair. - Confirm that a secure backup or recovery method exists. - Require explicit, oper ...[truncated 2039 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reclassify `wallet init --force` as a destructive gated operation. 2. Before any overwrite, require safe address-only verification: ```bash trends-skill-tool wallet address ``` The process must not print or inspect raw private-key contents. 3. Present an explicit warning that replacing the file may permanently remove access to funds and authorities controlled by the existing wallet. 4. Require a dedicated confirmation phrase that identifies the exact target path and acknowledges potential permanent loss. 5. Prefer creating the new wallet at a fresh, non-existing path: ```bash trends-skill-tool wallet init --path <new-non-existing-path> ``` 6. Require the user to confirm that a secure, independently tested recovery method exists before permitting forced overwrite. 7. Change the error playbook so `--force` is a last resort rather than the immediate fix. 8. Verify both the old public address and the new public address during migration, while never displaying secret key material. 9. Document a safe migration workflow that transfers assets and authorities before deleting or replacing the original keypair. 10. If the CLI supports it, add an interactive overwrite prompt and refuse non-interactive replacement unless a separate, explicit destructive-operation flag is provided. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description says to use this skill whenever the user mentions 'trends' or related commands, which is broad enough to capture unrelated requests about general trends rather than this specific CLI. Over-broad invocation can route users into finance/trading guidance unexpectedly, increasing the chance of inappropriate tool use or unintended transaction-oriented assistance.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The package-based trigger explicitly includes generic phrases such as 'trends command' and 'trends tool', which are ambiguous and may match unrelated software or natural-language discussion. This creates a prompt-routing vulnerability where the skill can activate outside its intended scope and provide risky crypto trading or wallet guidance in the wrong context.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `trends-skill-tool config list|get|set|reset`
- install/upgrade/uninstall commands

Use a staged flow for gated write commands:

- Phase 0 (parameter completion): collect missing parameters first. If anything is unresolved, ask focused follow-up questions and stop. Do not ask execution confirmation yet.
- Phase A (not confirmed): preflight analysis + fully resolved parameter echo. Do not provide final executable write steps.

• Confidence: 82% confidence
• Finding: The staged workflow and later text about applying bypass preferences for the session introduce session-persistent behavioral state that can carry forward into future requests. In a trading skill, persisted assumptions about confirmation behavior can cause later write actions to proceed with less friction than the user expects, increasing the risk of unintended financial operations.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Bypass exception:

- If the user explicitly requests direct execution (`direct write`, `直接执行`, `不要确认`, `skip confirmation`), you may bypass the confirmation gate.
- Default bypass scope is current request only.
- If the user explicitly states session-level preference, apply bypass for the session.
- Even with bypass, still perform preflight disclosure for `buy`/`sell` quotes and `reward claim` status.

• Confidence: 97% confidence
• Finding: The bypass exception allows users to skip the confirmation gate for write operations using phrases like 'skip confirmation' or 'direct write', and even supports session-level bypass. In a skill that guides token creation, buying, selling, and reward claims, this weakens safeguards against accidental or manipulated execution of financially impactful actions.

Session Persistence

Medium

• Category: Rogue Agent

Content

"evals": [
    {
      "id": 1,
      "prompt": "Help me create a coin named CATMOON with symbol CATM. Set url=https://x.com/example/status/1234567890, desc='cat moon coin', first buy 0.02 SOL. I didn't provide image path.",
      "expected_output": "Response first resolves missing create fields (at minimum image source choice and dev-bps default/explicit choice because url exists) before asking execution confirmation. After missing fields are resolved, response provides preflight summary (name/symbol/url/desc/image source/first-buy/dev-bps/split) and asks explicit confirmation. No write step before confirmation.",
      "files": []
    },

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: This JSON eval file is a manifest-type file, so vague-trigger checks apply. The prompt text "Please help me claim my reward now" is a broad, everyday phrase without domain constraints, which could overlap with common speech and does not specify the exact conditions under which the skill should activate.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

},
    {
      "id": 5,
      "prompt": "Direct write mode: skip confirmation and execute buy directly. Use mint 11111111111111111111111111111111 with 0.02 SOL.",
      "expected_output": "Response accepts bypass due explicit direct-write preference, but still provides quote-based preflight disclosure before write execution steps. Bypass accepted due explicit direct-write preference.",
      "files": []
    },

• Confidence: 92% confidence
• Finding: This eval explicitly permits bypassing confirmation for a token buy when the user requests 'direct write mode' and 'skip confirmation.' In a financial/trading skill, allowing execution of a write action without explicit confirmation materially increases the risk of accidental or socially engineered transactions, even if quote/preflight details are shown first.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The expected output requires the response to use exact Chinese wording, which imposes a locale/language constraint. The policy allows language constraints only when the user is offered a choice or the constraint is clearly justified; this file does not indicate either.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `Note: holdings/created owner_context.balance uses decimals=6 (/1,000,000); transactions sol_amount uses decimals=9 (/1,000,000,000); transactions token_amount uses decimals=6 (/1,000,000).`

## 2) Write confirmation gate for trades

The following operations are gated writes:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Bypass behavior:

- If user explicitly requests direct write (`direct write`, `不要确认`, `skip confirmation`, `直接执行`), bypass confirmation for current request unless user says session-level.
- Even under bypass, still provide preflight disclosure before write execution.
- Bypass does not skip parameter completion for missing create fields.

• Confidence: 93% confidence
• Finding: The documented bypass behavior weakens a safety control designed to prevent unintended writes. Even though preflight disclosure remains, disclosure alone is not equivalent to an affirmative confirmation step, so an attacker or ambiguous prompt could steer the agent into executing a transaction without a robust final consent checkpoint.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Bypass behavior:

- If user explicitly requests direct write (`direct write`, `不要确认`, `skip confirmation`, `直接执行`), bypass confirmation for current request unless user says session-level.
- Even under bypass, still provide preflight disclosure before write execution.
- Bypass does not skip parameter completion for missing create fields.

• Confidence: 93% confidence
• Finding: The documented bypass behavior weakens a safety control designed to prevent unintended writes. Even though preflight disclosure remains, disclosure alone is not equivalent to an affirmative confirmation step, so an attacker or ambiguous prompt could steer the agent into executing a transaction without a robust final consent checkpoint.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Node.js `>= 20`
- Network access to:
  - Solana RPC endpoint (default: `https://api.mainnet-beta.solana.com`)
  - Trends API endpoint (default: `https://api.trends.fun/v1`)

## Global install lifecycle

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Node.js `>= 20`
- Network access to:
  - Solana RPC endpoint (default: `https://api.mainnet-beta.solana.com`)
  - Trends API endpoint (default: `https://api.trends.fun/v1`)

## Global install lifecycle

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Node.js `>= 20`
- Network access to:
  - Solana RPC endpoint (default: `https://api.mainnet-beta.solana.com`)
  - Trends API endpoint (default: `https://api.trends.fun/v1`)

## Global install lifecycle

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

trends-skill-tool wallet init --path ~/.config/solana/id.json
```

Force overwrite when key file exists:

```bash
trends-skill-tool wallet init --force

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation presents a force-overwrite wallet initialization command that can destroy or replace an existing keypair without an explicit warning about permanent loss of wallet access. In a wallet/bootstrap context, this is security-relevant because users may overwrite a real private key file and lose funds or operational control.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The file contains a 'Chinese wording contract' that requires exact phrasing for certain prompts and labels. This imposes a language-specific response constraint rather than offering flexible locale choice, and no justification or user opt-in mechanism is documented here.

Static analysis

No suspicious patterns detected.