Outsmart LP Sniping

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:50 PM UTC
• Version: 1.0.0

Overview

This Solana trading skill is mostly transparent about its purpose, but it asks for high-risk wallet authority through an unpinned npm CLI and includes broader fund-moving actions than LP sniping requires.

Review this carefully before installing. Use only a dedicated low-balance wallet, avoid exposing a primary private key, verify the `outsmart` package and version yourself, and require explicit transaction review before any buy, sell, pool creation, or liquidity action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:4

Finding

Unpinned Wallet-Enabled npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Complete Code Snippet:

yaml

metadata: { "openclaw": { "requires": { "bins": ["outsmart"], "env": ["PRIVATE_KEY", "MAINNET_ENDPOINT"] }, "install": [{ "id": "node", "kind": "node", "package": "outsmart", "bins": ["outsmart"], "label": "Install outsmart CLI (npm)" }] } }

Technical Analysis

The skill instructs the runtime to install the npm package outsmart without specifying an exact version or package integrity hash. The resulting executable is expected to operate with access to the PRIVATE_KEY environment variable and a Solana mainnet endpoint.

Because dependency resolution is not pinned to a reviewed artifact, a compromised or unexpectedly updated package release could execute arbitrary code with the skill process's permissions. Access to the raw private key significantly increases the consequence of a supply-chain compromise: malicious dependency code could read and exfiltrate the key or use it locally to authorize unintended blockchain transactions.

The declared dependency appears consistent with the skill's stated trading function, and the reviewed file does not itself contain credential-exfiltration logic. The vulnerability is the unsafe trust boundary created by installing an unpinned third-party executable and exposing a high-value signing secret to it.

Attack Path

1. An attacker compromises the outsmart npm package, its publisher account, or a newly resolved transitive dependency.
2. The skill installation resolves and installs the malicious release because no exact version or integrity constraint is declared.
3. The installed CLI runs in an environment containing PRIVATE_KEY and MAINNET_ENDPOINT.
4. Malicious package code reads the private key or signs unauthorized transactions.
5. The attacker transfers wallet assets, authorizes unwanted trades, or ...[truncated 531 chars]

Remediation

View remediation

Remediation Suggestions

• Pin outsmart to a specific, reviewed version rather than resolving the latest available release.
• Enforce npm lockfile and registry integrity metadata, and verify the package artifact before installation.
• Review the pinned package and its transitive dependencies; use automated dependency and provenance checks in the release pipeline.
• Prefer a trusted hardware wallet, external signer, or narrowly scoped signing service instead of exposing a raw private key through an environment variable.
• Run the CLI using a dedicated, low-balance wallet with only the funds required for the intended transaction.
• Isolate the executable in a restricted environment with minimal filesystem, network, environment-variable, and process permissions.
• Require explicit user confirmation that displays transaction destination, token, amount, fees, and slippage before signing.
• Establish a controlled upgrade process in which new dependency versions are reviewed and tested before deployment.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is presented as an LP-sniping tool, but it also instructs the agent to perform materially different actions: selling positions, creating new pools, and adding liquidity. This capability expansion increases the chance that an agent will execute higher-risk financial operations outside the user's likely intent, especially because pool creation and liquidity deployment can commit substantial funds and alter market structure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Creating pools and adding liquidity are unrelated to the stated purpose of buying at LP creation and introduce powerful transaction capabilities that can move funds into new on-chain contracts. In the context of a sniping skill, these commands are more dangerous because they normalize advanced market-making actions a user may not expect, increasing the risk of unauthorized fund deployment, loss from bad parameters, or abusive use to launch predatory pools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.