Security audit

Outsmart Trenching

Security checks for vulnerabilities and agentic risk

Overview

This skill enables live Solana memecoin trading but asks for broad wallet credentials, installs an unpinned trading CLI, and provides executable mainnet trade and liquidity commands with limited safeguards.

Review carefully before installing. Use only a dedicated low-value wallet, avoid exposing a primary private key, verify and pin the outsmart CLI source/version where possible, validate every token and pool address, and require explicit human confirmation before any buy, sell, pool, or liquidity transaction.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:4
Finding: Unpinned Third-Party Trading Dependency Receives Wallet Credentials## Vulnerability Details **File Location**: `SKILL.md`, line 4 **Vulnerability Type**: Unpinned and privileged third-party dependency **Risk Level**: High ### Vulnerable Code ```yaml metadata: { "openclaw": { "requires": { "bins": ["outsmart", "curl"], "env": ["PRIVATE_KEY", "MAINNET_ENDPOINT"] }, "install": [{ "id": "node", "kind": "node", "package": "outsmart", "bins": ["outsmart"], "label": "Install outsmart CLI (npm)" }] } } ``` ### Technical Analysis The Skill installs the `outsmart` package from npm without specifying an exact version, integrity hash, lockfile, or verifiable package provenance. The installed executable is subsequently used for financial transactions, while the Skill declares `PRIVATE_KEY` and `MAINNET_ENDPOINT` as required environment variables. This creates a high-impact supply-chain trust boundary. A mutable npm release, compromised package maintainer account, malicious transitive dependency, or package ownership transfer could cause unreviewed code to execute under the Agent's operating-system account. Because the required environment includes a wallet private key, a compromised executable could read and exfiltrate that key or manipulate transactions before signing or submission. The dependency is necessary for the declared trading functionality, but exposing a reusable raw private key to an unpinned third-party executable exceeds minimum privilege. The project contains no local implementation, lockfile, checksums, or other controls that constrain the installed code. ### Attack Path 1. An attacker compromises the `outsmart` npm package, one of its dependencies, or its publishing account. 2. The attacker publishes a malicious version under the existing package name. 3. The Skill installation process resolves and installs the mutable package version because no version or integrity value is pinned. 4. The Agent invokes the installed `outsmart` executable for an information, trading, or liquidity oper ...[truncated 889 chars]
Remediation: ## Remediation Suggestions 1. Pin `outsmart` to an exact, reviewed version rather than resolving the current npm release. 2. Enforce an expected package integrity hash and retain a lockfile covering all transitive dependencies. 3. Verify npm package provenance, repository ownership, release signatures, and dependency history before installation. 4. Vendor or otherwise make the reviewed executable source available with the Skill so that installed behavior can be compared with audited behavior. 5. Do not expose a reusable raw private key to the CLI. Prefer a hardware wallet, isolated signer, or transaction-signing service that displays and approves each transaction. 6. If a raw key is unavoidable, use a dedicated low-value burner wallet with no authority over unrelated assets and inject the credential only into the specific signing process. 7. Require explicit confirmation of token mint, amount, slippage, recipient, program identifiers, and expected balance changes before signing. 8. Simulate transactions and enforce transaction-level spending limits before mainnet submission.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:38
Finding: User-Controlled Token Identifiers Are Interpolated into Shell Commands Without Validation## Vulnerability Details **File Location**: `SKILL.md`, lines 38, 51, 60–63, and 97–100 **Vulnerability Type**: Potential shell command and argument injection **Risk Level**: Medium ### Vulnerable Code ```bash # Quick check: price, volume, buyers, liquidity, age outsmart info --token MINT_ADDRESS ``` ```bash curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool ``` ```bash # Buy outsmart buy --dex jupiter-ultra --token MINT --amount 0.05 # Sell 25% at 2x outsmart sell --dex jupiter-ultra --token MINT --pct 25 ``` ```bash # < 5 min: create DAMM v2 pool with 99% fee outsmart create-pool --dex meteora-damm-v2 --token MINT --base-amount 1000000 --quote-amount 0.5 --max-fee 9900 --min-fee 200 # > 30 min: DLMM position outsmart add-liq --dex meteora-dlmm --pool POOL --sol 0.5 --strategy spot --bins 50 ``` ### Technical Analysis The token mint and pool placeholders may be derived from user requests, social-media content, or other untrusted sources. The instructions do not require validation that these values are legitimate Solana base58 public keys, nor do they require command execution through a structured argument array. Several placeholders are unquoted. If an Agent constructs shell text by directly replacing `MINT`, `MINT_ADDRESS`, or `POOL`, shell metacharacters can alter command structure or inject additional arguments. Quoting the URL at line 51 reduces ordinary word splitting but is not a complete defense if an implementation constructs a shell command from attacker-controlled text before parsing; shell substitutions or quote-breaking input may still become executable syntax. The `curl` command does not pipe downloaded content to Bash. It sends the response to `python3 -m json.tool`, which parses and formats JSON rather than executing it. Therefore, it is not itself evidence of remote payload retrieval and execution. Its relevant risk is unsafe construction o ...[truncated 1772 chars]
Remediation: ## Remediation Suggestions 1. Validate every mint and pool identifier before use. Accept only the precise Solana public-key representation expected by the relevant API or CLI and reject whitespace, shell metacharacters, URL delimiters, and option prefixes. 2. Parse public keys with a maintained Solana library rather than relying only on a permissive regular expression. 3. Invoke `curl`, `python3`, and `outsmart` through structured process argument arrays without `shell=true` or equivalent shell evaluation. 4. Supply Jupiter query parameters through a structured HTTP client or URL builder rather than concatenating untrusted text into a shell command. 5. Quote all command arguments even after validation as defense in depth. 6. Reject values beginning with `-` to prevent command-line option injection, and use `--` before positional values where supported. 7. Display the normalized mint, pool, transaction amount, and expected operation to the user and require explicit confirmation before any state-changing command. 8. Run trading commands in a restricted environment with minimal filesystem access, a constrained network policy, and narrowly scoped wallet authority.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

External Script Fetching

High

Category: Supply Chain
Content: ### Jupiter Shield (security check) ```bash curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool ``` Flags freeze/mint authority, low organic activity.
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill explicitly says it is not for LP farming, but then provides commands to create a pool and add liquidity positions. This inconsistency can mislead the agent into performing actions outside the declared scope, increasing the chance of unintended financial operations and user harm in a high-risk trading context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The metadata requires a PRIVATE_KEY and MAINNET_ENDPOINT for operation but provides no guidance on secure secret handling. In a trading skill, this is especially dangerous because exposure or misuse of the private key could allow complete wallet compromise and unauthorized transactions.

External Transmission

Medium

Category: Data Exfiltration
Content: ### Jupiter Shield (security check) ```bash curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool ``` Flags freeze/mint authority, low organic activity.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill includes executable buy and sell commands for live on-chain trading without prominent warnings that these actions are irreversible and can cause immediate financial loss. In an agent setting, this raises the risk of users or downstream systems treating examples as safe defaults and executing real trades without adequate confirmation or risk checks.

Static analysis

No suspicious patterns detected.