Outsmart Devving Coins

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:51 PM UTC
• Version: 1.0.0

Overview

This skill is coherent for Solana token launching, but it asks an agent to install an unpinned third-party CLI and use a raw mainnet wallet private key for irreversible financial actions without enough safety boundaries.

Review this carefully before installing. Use only a dedicated low-balance wallet, avoid exposing a primary private key, verify the outsmart CLI package and version yourself, and require full transaction review before signing any mainnet launch, pool, or liquidity command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Unpinned Third-Party CLI Receives Wallet Private Key Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-5
Vulnerability Type: Unpinned third-party dependency with access to sensitive wallet credentials
Risk Level: High

Vulnerable Code

yaml

metadata: { "openclaw": { "requires": { "bins": ["outsmart"], "env": ["PRIVATE_KEY", "MAINNET_ENDPOINT"] }, "install": [{ "id": "node", "kind": "node", "package": "outsmart", "bins": ["outsmart"], "label": "Install outsmart CLI (npm)" }] } }

The installed CLI is subsequently instructed to perform wallet-backed mainnet operations:

bash

outsmart create-coin --name "Token Name" --symbol "TICKER" --metadata-uri "https://arweave.net/..."

bash

outsmart create-pool --dex meteora-damm-v2 --token MINT \
  --base-amount 1000000 --quote-amount 0.5 \
  --max-fee 9900 --min-fee 200 --duration 86400 --periods 100

outsmart add-liq --dex meteora-dlmm --pool POOL --sol 0.5 --strategy spot --bins 50

Technical Analysis

The Skill installs the npm package outsmart without specifying an exact version, lockfile integrity value, artifact digest, or verifiable package provenance. The executable is therefore resolved from mutable third-party registry state at installation time.

At the same time, the Skill declares PRIVATE_KEY and MAINNET_ENDPOINT as required environment variables. The installed executable can consequently inherit or otherwise access a private signing key while carrying out token creation and liquidity operations. The referenced GitHub homepage does not cryptographically establish that the npm artifact installed at runtime corresponds to reviewed source code.

No direct malicious implementation was found in SKILL.md; the risk arises from delegating sensitive mainnet operations to an unpinned and unaudited dependency.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or a future release of outsmart.
2. The Skill installs the package without a version pin or integrity ve ...[truncated 1205 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin outsmart to a specific, audited version rather than resolving an unspecified registry release.
2. Enforce lockfile integrity hashes or an equivalent immutable artifact digest during installation.
3. Verify npm publisher identity, package provenance, release signatures, and correspondence between the published artifact and reviewed repository source.
4. Vendor and review the executable source where practical, and build it through a controlled, reproducible process.
5. Do not expose a raw wallet private key to the CLI. Prefer a hardware wallet, external signer, isolated signing service, or narrowly scoped transaction-approval interface.
6. Use a dedicated low-value burner wallet with only the funds required for the intended transaction.
7. Decode and display the complete transaction—including programs, accounts, recipients, amounts, and authorities—before requesting explicit user approval and signing.
8. Restrict network egress and runtime permissions so the CLI cannot transmit credentials to unrelated endpoints.
9. Rotate the wallet key immediately if it has already been exposed to an untrusted or unverifiable package release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly requires a PRIVATE_KEY and MAINNET_ENDPOINT but provides no safety guidance on secret handling, wallet isolation, or mainnet transaction risk. In an agent setting, this can normalize exposing signing credentials to automation and increases the chance of key compromise or unintended use of a funded wallet.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented commands initiate irreversible on-chain actions including token creation, pool creation, and liquidity deployment, yet they omit explicit warnings that these spend funds and cannot be undone once broadcast. In an agent-assisted workflow, users may treat example commands as safe defaults and accidentally execute costly or reputation-damaging transactions on mainnet.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says this skill is for launching tokens on Solana launchpads and explicitly says it is not for LP on existing pools. However, the documented behavior includes creating a DAMM v2 pool and adding liquidity after graduation, which are distinct post-launch liquidity operations rather than token launch actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.