4CHAD

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

The skill does what it advertises, but it gives an agent broad live-wallet authority to sign and submit real Solana transactions with weak safety boundaries.

Review carefully before installing. Use only a dedicated low-balance wallet, avoid primary wallet private keys, decode or simulate every transaction before signing, set hard trade and slippage limits, and do not run the bot or harvesting loops unattended unless you have monitoring and a clear stop mechanism.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The skill advertises token launching, trading, and fee claiming, but it also instructs the agent to download and use an external script to sign raw Solana transactions with a private key passed on the command line. That materially expands capability from platform-specific actions to signing potentially arbitrary transactions, which is dangerous because users may not realize they are granting generalized wallet authority rather than narrowly scoped 4chad operations.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The examples significantly expand the skill from simple token launch/trade/fee claims into autonomous trading bots, portfolio management, and continuous harvesting loops. In a wallet-connected crypto skill, that scope expansion materially increases risk by encouraging unattended execution of market trades and transaction submissions without strong safety controls, budget limits, or operator confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The setup instructions persist API credentials in ~/.bashrc and write them to ~/.4chad_api_key, creating long-lived local secret exposure beyond the minimum needed for a trading example. This increases the blast radius of compromise from shell history, local file disclosure, backup leakage, or multi-user host access, especially in automation environments where secrets often propagate broadly.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The examples instruct users to export a Solana private key and persist an API key, yet provide no prominent warning about secret handling, host trust, or the financial consequences of compromise. For a blockchain trading skill, credential exposure directly enables unauthorized signing workflows, API abuse, and asset loss.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The autonomous trading bot continuously monitors quotes and submits trades with no human confirmation, policy limits, or realistic warnings about slippage, market manipulation, liquidity, or loss. In crypto contexts, unattended transaction loops are especially dangerous because they can rapidly convert volatility, bad quotes, or malicious token conditions into irreversible on-chain losses.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This example walks the user through obtaining an unsigned transaction, signing it with a private key, and submitting it on-chain, but it does not clearly warn that the commands trigger real blockchain actions affecting funds. In an autonomous agent context, copy-pasting or automating this flow can cause unintended claims, fees, or wallet activity without an explicit confirmation step.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These unattended loops repeatedly request claim transactions, sign them, and submit them using live API keys and a private key, but the documentation does not prominently warn about continuous real-money execution. In an agent setting, this increases the risk of accidental bulk on-chain activity, runaway automation, repeated fee spending, and signing of unexpected transactions returned by the remote service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The batch claim example loops across all tokens and submits signed transactions in bulk without a direct warning that it can execute multiple financial operations at once. In a wallet-integrated agent workflow, this can magnify mistakes, cause unintended claims across many assets, and normalize blind signing of transactions from an external API.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The launch workflow instructs users to create, sign, and submit a transaction that will mint a token and spend SOL, but it does not explicitly warn that blockchain submission is irreversible and can create permanent on-chain assets. In an autonomous-agent context, missing this warning increases the chance of accidental asset creation or unintended fund expenditure if the agent submits a transaction without clear human confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide references passing a private key into a local signing command without any warning about secure key handling, storage, logging, shell history exposure, or environment leakage. In agent-driven workflows, this can lead operators to expose wallet credentials to scripts, subprocesses, or telemetry systems, risking total wallet compromise.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The skill includes very broad natural-language activation phrases such as launching tokens, trading assets, claiming fees, and checking wallet balances. In an agent ecosystem, these generic triggers can cause accidental invocation during ordinary conversation, increasing the chance of unintended financial actions or exposure of wallet-related context.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: The skill presents token launch and trading workflows as quick examples without prominently warning that blockchain transactions are irreversible and can cause immediate financial loss. In this context, an autonomous-agent skill that can create tokens and trade assets is especially risky because users may treat examples as safe defaults and execute them without appreciating slippage, fraud, or permanent loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide presents live trading and transaction submission commands as routine setup without an explicit warning that they execute real on-chain swaps and can irreversibly spend funds. In a trading skill for autonomous agents, this omission materially increases the chance that users or agents run examples against production wallets without understanding the financial consequences.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The DCA and take-profit scripts contain unattended loops that can continuously create, sign, and submit live trades with no per-trade confirmation or spend limits. In an autonomous agent context, this is especially risky because a misconfiguration, bad market data, or prompt-triggered execution could repeatedly drain funds before the operator notices.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The description advertises broad autonomous DeFi capabilities like launching tokens, trading assets, and claiming fees without stating clear user-trigger conditions, approval boundaries, or safety constraints. In a skill that can access a Solana private key and create/submit transactions, vague invocation language increases the chance the agent may over-apply the skill in high-risk financial contexts.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.