Sur

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:09 PM UTC
• Version: 1.0.0

Overview

The skill matches its stated SURGE token-launch and trading purpose, but it needs Review because it can create custodial wallets and execute financial trades without enough explicit confirmation and slippage protection.

Review this carefully before installing. Only use it if you are comfortable giving an agent a SURGE API key that can create custodial wallets, use one-time funding, launch tokens, approve token allowances, and place live trades. Require explicit confirmation for every wallet creation, funding action, token launch, approval, and trade, and avoid EVM trades with amountOutMin set to 0.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:438

Finding

EVM Trade Examples Disable Slippage Protection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 438-469
Vulnerability Type: Unprotected decentralized-exchange swaps caused by a zero minimum-output value
Risk Level: High

Vulnerable Code

markdown

### Buy EVM Tokens

POST /openclaw/buy
{
  "chainId": "1",
  "walletId": "abc123",
  "tokenAddress": "0x...",
  "ethAmount": "0.01",
  "amountOutMin": "0"
}

Works for **both** bonding curve and post-DEX. The API detects the phase automatically.

### Sell EVM Tokens

POST /openclaw/sell
{
  "chainId": "1",
  "walletId": "abc123",
  "tokenAddress": "0x...",
  "tokenAmount": "1000",
  "amountOutMin": "0"
}

Notes:
- Auto-approves ERC-20 allowance if needed (both bonding curve and Aerodrome router)
- Don't sell too much at once — can cause revert on small pools
- `amountOutMin: "0"` = no slippage protection (use `getQuote` to set a reasonable value for post-DEX)
- For post-DEX sells: you're selling the `agentToken`, but pass the original `tokenAddress` — the API resolves it

Technical Analysis

The documented EVM buy and sell requests explicitly set amountOutMin to "0". This value permits a transaction to execute regardless of how few output assets the user receives. Although the document acknowledges that this means there is no slippage protection, it still presents the unsafe value in the primary trading examples.

On automated-market-maker exchanges, transaction prices can change between request preparation and on-chain execution. A zero minimum-output constraint removes the normal safeguard that would revert a transaction when execution differs materially from the quoted price. This exposes trades to ordinary market volatility, low-liquidity price impact, and deliberate miner/maximal extractable value activity such as sandwich attacks.

The instruction to use a quote is limited to post-DEX trading and is phrased as optional guidance. The Skill does not require a fresh quote, calculate a nonzero minimum output, enforce a tran ...[truncated 1470 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove amountOutMin: "0" from all documented trading examples and prohibit zero minimum-output values at the API-validation layer.

2. Obtain a fresh quote immediately before every buy or sell, including both bonding-curve and post-DEX trades.

3. Ask the user to approve a bounded maximum-slippage percentage rather than silently choosing an unlimited value.

4. Calculate the protected minimum output using the quoted output and approved tolerance:

   text

   amountOutMin = quotedAmountOut × (1 - approvedSlippage)
   

5. Require amountOutMin to be a positive integer in the asset's smallest denomination and reject malformed, zero, or negative values.

6. Add a short transaction deadline or quote expiration time so stale transactions cannot execute after market conditions change materially.

7. Before submission, show the expected output, guaranteed minimum output, price impact, fees, and selected slippage tolerance.

8. Require renewed confirmation when price impact or slippage exceeds a conservative threshold.

9. Re-quote and request confirmation rather than automatically retrying a transaction after a slippage-related revert.

10. Apply server-side controls so safety does not depend exclusively on an AI agent correctly interpreting documentation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to create custodial, server-managed wallets and trigger one-time funding before requiring a clear, explicit user acknowledgement of custody, wallet creation, and account-side effects. Because these actions create persistent financial accounts and may consume a one-time subsidy, an agent following the instructions could make irreversible or user-significant changes without sufficiently informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trading section enables buy/sell operations that spend wallet funds and execute live market transactions, but it does not impose an explicit per-trade confirmation requirement. In a volatile DeFi context, this is dangerous because an agent could place unintended trades, spend user assets, or execute at poor prices without a final consent checkpoint.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The skill states that token sells will auto-approve ERC-20 allowances if needed, allowing the system to grant spending permissions as part of a trade flow without a separate approval step. Automatic approval expands the scope of asset access and can expose users to unintended token permissions, especially when combined with autonomous trading and no mandatory confirmation for approval parameters.

Content

Scanner excerpt · SKILL.md (reported line 467)May include surrounding context.

text

Notes:
- Auto-approves ERC-20 allowance if needed (both bonding curve and Aerodrome router)
- Don't sell too much at once — can cause revert on small pools
- `amountOutMin: "0"` = no slippage protection (use `getQuote` to set a reasonable value for post-DEX)
- For post-DEX sells: you're selling the `agentToken`, but pass the original `tokenAddress` — the API resolves it

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

> 3. Go to **Settings → API Keys**
> 4. Click **Generate** and give it a name (e.g. "My Agent")
> 5. **Copy the key immediately** — it's shown only once!
> 6. Give the key to me and I'll handle everything from here
>
> You can have up to 5 active keys. If you lose one, revoke it and create a new one.

Static analysis

No suspicious patterns detected.