ClawHub
Back to skill

Security audit

Outsmart Trenching

Security checks for vulnerabilities and agentic risk

Overview

This skill enables live Solana memecoin trading but asks for broad wallet credentials, installs an unpinned trading CLI, and provides executable mainnet trade and liquidity commands with limited safeguards.

Review carefully before installing. Use only a dedicated low-value wallet, avoid exposing a primary private key, verify and pin the outsmart CLI source/version where possible, validate every token and pool address, and require explicit human confirmation before any buy, sell, pool, or liquidity transaction.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:4
Finding

Unpinned Third-Party Trading Dependency Receives Wallet Credentials

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Unpinned and privileged third-party dependency
Risk Level: High

Vulnerable Code

yaml
metadata: { "openclaw": { "requires": { "bins": ["outsmart", "curl"], "env": ["PRIVATE_KEY", "MAINNET_ENDPOINT"] }, "install": [{ "id": "node", "kind": "node", "package": "outsmart", "bins": ["outsmart"], "label": "Install outsmart CLI (npm)" }] } }

Technical Analysis

The Skill installs the outsmart package from npm without specifying an exact version, integrity hash, lockfile, or verifiable package provenance. The installed executable is subsequently used for financial transactions, while the Skill declares PRIVATE_KEY and MAINNET_ENDPOINT as required environment variables.

This creates a high-impact supply-chain trust boundary. A mutable npm release, compromised package maintainer account, malicious transitive dependency, or package ownership transfer could cause unreviewed code to execute under the Agent's operating-system account. Because the required environment includes a wallet private key, a compromised executable could read and exfiltrate that key or manipulate transactions before signing or submission.

The dependency is necessary for the declared trading functionality, but exposing a reusable raw private key to an unpinned third-party executable exceeds minimum privilege. The project contains no local implementation, lockfile, checksums, or other controls that constrain the installed code.

Attack Path

  1. An attacker compromises the outsmart npm package, one of its dependencies, or its publishing account.
  2. The attacker publishes a malicious version under the existing package name.
  3. The Skill installation process resolves and installs the mutable package version because no version or integrity value is pinned.
  4. The Agent invokes the installed outsmart executable for an information, trading, or liquidity oper ...[truncated 889 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin outsmart to an exact, reviewed version rather than resolving the current npm release.
  2. Enforce an expected package integrity hash and retain a lockfile covering all transitive dependencies.
  3. Verify npm package provenance, repository ownership, release signatures, and dependency history before installation.
  4. Vendor or otherwise make the reviewed executable source available with the Skill so that installed behavior can be compared with audited behavior.
  5. Do not expose a reusable raw private key to the CLI. Prefer a hardware wallet, isolated signer, or transaction-signing service that displays and approves each transaction.
  6. If a raw key is unavoidable, use a dedicated low-value burner wallet with no authority over unrelated assets and inject the credential only into the specific signing process.
  7. Require explicit confirmation of token mint, amount, slippage, recipient, program identifiers, and expected balance changes before signing.
  8. Simulate transactions and enforce transaction-level spending limits before mainnet submission.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:38
Finding

User-Controlled Token Identifiers Are Interpolated into Shell Commands Without Validation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38, 51, 60–63, and 97–100
Vulnerability Type: Potential shell command and argument injection
Risk Level: Medium

Vulnerable Code

bash
# Quick check: price, volume, buyers, liquidity, age
outsmart info --token MINT_ADDRESS
bash
curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool
bash
# Buy
outsmart buy --dex jupiter-ultra --token MINT --amount 0.05

# Sell 25% at 2x
outsmart sell --dex jupiter-ultra --token MINT --pct 25
bash
# < 5 min: create DAMM v2 pool with 99% fee
outsmart create-pool --dex meteora-damm-v2 --token MINT --base-amount 1000000 --quote-amount 0.5 --max-fee 9900 --min-fee 200

# > 30 min: DLMM position
outsmart add-liq --dex meteora-dlmm --pool POOL --sol 0.5 --strategy spot --bins 50

Technical Analysis

The token mint and pool placeholders may be derived from user requests, social-media content, or other untrusted sources. The instructions do not require validation that these values are legitimate Solana base58 public keys, nor do they require command execution through a structured argument array.

Several placeholders are unquoted. If an Agent constructs shell text by directly replacing MINT, MINT_ADDRESS, or POOL, shell metacharacters can alter command structure or inject additional arguments. Quoting the URL at line 51 reduces ordinary word splitting but is not a complete defense if an implementation constructs a shell command from attacker-controlled text before parsing; shell substitutions or quote-breaking input may still become executable syntax.

The curl command does not pipe downloaded content to Bash. It sends the response to python3 -m json.tool, which parses and formats JSON rather than executing it. Therefore, it is not itself evidence of remote payload retrieval and execution. Its relevant risk is unsafe construction o ...[truncated 1772 chars]

Remediation
View remediation

Remediation Suggestions

  1. Validate every mint and pool identifier before use. Accept only the precise Solana public-key representation expected by the relevant API or CLI and reject whitespace, shell metacharacters, URL delimiters, and option prefixes.
  2. Parse public keys with a maintained Solana library rather than relying only on a permissive regular expression.
  3. Invoke curl, python3, and outsmart through structured process argument arrays without shell=true or equivalent shell evaluation.
  4. Supply Jupiter query parameters through a structured HTTP client or URL builder rather than concatenating untrusted text into a shell command.
  5. Quote all command arguments even after validation as defense in depth.
  6. Reject values beginning with - to prevent command-line option injection, and use -- before positional values where supported.
  7. Display the normalized mint, pool, transaction amount, and expected operation to the user and require explicit confirmation before any state-changing command.
  8. Run trading commands in a restricted environment with minimal filesystem access, a constrained network policy, and narrowly scoped wallet authority.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Jupiter Shield (security check)

bash
curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool

Flags freeze/mint authority, low organic activity.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly says it is not for LP farming, but then provides commands to create a pool and add liquidity positions. This inconsistency can mislead the agent into performing actions outside the declared scope, increasing the chance of unintended financial operations and user harm in a high-risk trading context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The metadata requires a PRIVATE_KEY and MAINNET_ENDPOINT for operation but provides no guidance on secure secret handling. In a trading skill, this is especially dangerous because exposure or misuse of the private key could allow complete wallet compromise and unauthorized transactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Jupiter Shield (security check)

bash
curl -s "https://api.jup.ag/ultra/v1/shield?mints=MINT_ADDRESS" | python3 -m json.tool

Flags freeze/mint authority, low organic activity.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill includes executable buy and sell commands for live on-chain trading without prominent warnings that these actions are irreversible and can cause immediate financial loss. In an agent setting, this raises the risk of users or downstream systems treating examples as safe defaults and executing real trades without adequate confirmation or risk checks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.