solana-bundler-sniper-volume-bot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:30 PM UTC
• Version: 1.0.2

Overview

This skill is openly a crypto trading agent, but it gives an agent broad live trading, wallet-draining, volume-generation, and fund-routing powers without enough safety controls or warnings.

Install only if you intentionally want an agent to control real crypto trading and wallet operations through GANK. Use test wallets first, keep the API key out of prompts/logs, prefer tightly scoped or low-balance keys if available, and require manual confirmation before any buy, sell, transfer, sweep, wallet drain, privacy route, copy-trade, or volume-bot action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: SKILL.md:181
• Finding: Coordinated Market Manipulation and Fund Obfuscation Capabilities<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:181-205`, `SKILL.md:223-240`, `SKILL.md:267-296`; supporting usage in `examples.md:145-177` and `examples.md:264-328` **Vulnerability Type**: Coordinated market manipulation and fund obfuscation **Risk Level**: Critical ### Vulnerable Code ```text **swarm buy** POST /phases/swarm/buy { "token_mint": "TokenMint...", "wallets": [ { "wallet_address": "SwarmWallet1...", "amount_sol": 0.05 }, { "wallet_address": "SwarmWallet2...", "amount_sol": 0.1 } ], "slippage_bps": 500 } ``` ```text **start** POST /phases/volume/start { "token_mint": "TokenMint...", "wallet_addresses": ["VolumeWallet1...", "VolumeWallet2..."], "sol_per_trade": 0.001, "duration_minutes": 60, "intensity": "medium" } ``` ```text **vamp all (drain wallets — sells tokens, closes accounts, sweeps sol)** POST /wallets/vamp-all { "source_wallets": ["Wallet1...", "Wallet2..."], "destination_wallet": "MainWallet..." } **clean funds (privacy swap — sol→bnb→sol or sol→eth→sol, ~5 min)** get a quote first: POST /wallets/clean-funds/quote { "amount_sol": 1.0, "route": "bnb" } initiate: POST /wallets/clean-funds { "source_wallets": ["Wallet1..."], "destination_wallets": ["FreshWallet1..."], "route": "bnb" } ``` The supporting pipeline starts an automated high-intensity volume session: ```typescript const { session_id } = await fetch(`${API}/phases/volume/start`, { method: 'POST', headers, body: JSON.stringify({ token_mint, wallet_addresses: volumeAddresses, sol_per_trade: 0.002, duration_minutes: 120, intensity: 'high', }), }).then(r => r.json()) ``` ### Technical Analysis The Skill exposes coordinated simultaneous purchases across multiple wallets, automated volume-generation sessions, complete wallet draining, and privacy-oriented cross-chain routing into fresh destination wallets. These are not merely passive market-data or ordinary single-wallet trading operations. The combined w ...[truncated 1850 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove automated volume-generation features and workflows designed to coordinate market activity across many wallets. - Remove or strictly isolate wallet-draining and fund-obfuscation endpoints. - Require explicit, transaction-specific human approval before every purchase, sale, transfer, sweep, account closure, or privacy swap. - Use separately scoped API keys for read-only market data, ordinary trading, wallet transfers, and administrative operations. - Default new credentials to read-only access and require explicit opt-in for transaction capabilities. - Enforce per-transaction, per-wallet, and daily value limits server-side. - Require destination-wallet allowlisting with an out-of-band verification delay before a new address can receive funds. - Provide transaction previews containing source wallets, destination wallets, estimated proceeds, fees, slippage, and irreversible effects. - Add comprehensive audit logs, anomaly detection, credential revocation, and alerts for multi-wallet or full-balance operations. - Prohibit automated artificial-volume generation and document acceptable-use restrictions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: examples.md:187
• Finding: Destructive Wallet Operations Execute Without Adequate Safety Controls<![CDATA[ ## Vulnerability Details **File Location**: `examples.md:187-215` and `examples.md:219-254` **Vulnerability Type**: Unsafe destructive financial operations **Risk Level**: High ### Vulnerable Code ```typescript async function recoverAllFunds(destinationWallet: string) { // get all swarm wallets const walletsRes = await fetch(`${API}/wallets/user`, { headers }).then(r => r.json()) const swarmAddresses = (walletsRes.swarm || []).map((w: any) => w.wallet_address) if (swarmAddresses.length === 0) { console.log('No swarm wallets to recover from.') return } // vamp all: sells tokens + closes accounts + sweeps sol const vampRes = await fetch(`${API}/wallets/vamp-all`, { method: 'POST', headers, body: JSON.stringify({ source_wallets: swarmAddresses, destination_wallet: destinationWallet, }), }).then(r => r.json()) console.log('Recovery complete:', vampRes) return vampRes } ``` The automated selling example also liquidates entire positions during a recurring polling loop: ```typescript if (currentMultiplier >= targetMultiplier) { console.log(`Selling ${pos.token_symbol} at ${currentMultiplier.toFixed(2)}x`) const sellRes = await fetch(`${API}/phases/regular/sell`, { method: 'POST', headers, body: JSON.stringify({ wallet_address: pos.wallet_address, token_mint: pos.token_mint, sell_percentage: 100, slippage_bps: 500, }), }).then(r => r.json()) console.log('Sell result:', sellRes) } // poll every 30 seconds setInterval(monitorAndSell, 30_000) ``` ### Technical Analysis The recovery example enumerates every swarm wallet and submits all addresses to an endpoint documented as selling tokens, closing accounts, and sweeping SOL. The destination is accepted directly from the caller without validation or allowlisting. The examples do not require interactive confirmation, display a transaction preview, impose value limits, verify that the destination belongs ...[truncated 1448 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit human confirmation immediately before destructive or irreversible operations. - Validate destination addresses against a server-side allowlist tied to the authenticated account. - Require out-of-band verification before adding or changing an allowed destination. - Display a dry-run preview listing every source wallet, asset to be sold, account to be closed, estimated proceeds, fees, slippage, and destination. - Replace unrestricted full-wallet operations with explicit per-wallet and per-asset selections. - Apply conservative transaction, wallet, and daily limits. - Require a second authentication factor or separately scoped credential for sweeping funds and closing accounts. - Validate `response.ok`, parse the documented `success` field, and reject malformed or partial responses. - Add idempotency keys and locking to prevent duplicate or concurrent liquidation requests. - Avoid `sell_percentage: 100` as an automated default; require an explicit bounded percentage from the user. - Replace autonomous recurring liquidation with notifications or approval requests when a target is reached. - Record tamper-resistant audit logs and alert users immediately when full-balance or multi-wallet actions are requested. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:6
• Finding: Unpinned Third-Party Installation Command Creates Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:6` **Vulnerability Type**: Unpinned third-party installer and mutable Skill source **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add pissdart/gank ``` ### Technical Analysis The documented installation command invokes an npm-resolved CLI through `npx` without pinning the CLI to a reviewed version. It also references a mutable repository identifier rather than a specific commit or signed release. Consequently, the content installed by a future execution may differ from the files reviewed in this audit. Compromise of the npm package, the package maintainer, the referenced repository, or its release process could introduce malicious Skill instructions or files after review. No evidence in the reviewed artifact proves that the current dependency is compromised. The finding concerns the absence of version and integrity controls in the recommended installation process. ### Attack Path 1. An attacker compromises the npm package resolved for the `skills` command, its maintainer account, or the referenced repository. 2. The attacker publishes a modified package or changes the mutable repository content. 3. A user runs the documented `npx skills add pissdart/gank` command. 4. `npx` resolves and runs the current package version rather than a previously reviewed version. 5. The installer retrieves and enables modified Skill content, which may execute or instruct the agent differently from this audited artifact. ### Impact Assessment The resulting privileges depend on the installer and runtime environment. A compromised installer could potentially act with the invoking user's local permissions, while malicious installed Skill content could access configured tools and credentials available to the agent. Given that this Skill uses a financial API credential, modified content could also attempt unauthorized transactions or transmit the credential if the runtime exposes it. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the `skills` CLI to a specific reviewed version rather than relying on the latest npm-resolved release. - Pin the Skill itself to an immutable commit hash or cryptographically signed release tag. - Publish and verify checksums or signatures for every distributed artifact. - Use package-lock or equivalent integrity metadata where applicable. - Document the exact expected repository commit and artifact digest. - Advise users to inspect downloaded Skill files and permission requirements before enabling them. - Use a trusted registry and enable maintainer multi-factor authentication and protected release workflows. - Add automated dependency and provenance verification to the release process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: These examples implement automated 'swarm buy' and 'volume bot' behaviors that are characteristic of coordinated market-manipulation activity rather than ordinary wallet management. In the context of a token-launch/trading skill, this materially increases the risk of abuse for wash trading, artificial price/volume inflation, and user harm, and the documentation normalizes such misuse by providing ready-to-run code.

Context-Inappropriate Capability

High

• Confidence: 94% confidence
• Finding: The bulk recovery example invokes an endpoint that sells tokens, closes accounts, and sweeps funds from multiple wallets to a destination address in one step. If triggered mistakenly, by compromised credentials, or with an attacker-controlled destination, it can rapidly cause irreversible asset liquidation and transfer across all swarm wallets.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: These examples describe irreversible actions including liquidation, account closure, sweeping funds, and automated selling, but they do not prominently warn users about financial loss, automation risk, or the consequences of running the code unattended. In this context, the lack of warnings makes dangerous actions appear routine and increases the likelihood of accidental self-harm or misuse.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The manifest explicitly advertises 'transfer, split, consolidate, and drain wallets' plus privacy-routing behavior, but provides no user-facing warning about irreversible fund movement, authorization requirements, or the risk of total asset loss. In an agent skill context, exposing destructive wallet operations without strong consent and safety language makes accidental or abusive execution materially more likely.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The README instructs users to run `npx skills add pissdart/gank` without pinning a version, which can fetch whatever package/version is current at execution time. That creates a supply-chain risk where users may install unexpected or malicious code if the upstream package or dependency chain changes or is compromised.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises high-risk wallet and token operations such as launching tokens, swarm buying, volume bots, fund cleaning, and wallet draining-like actions without any warning about financial loss, irreversible transactions, legal/compliance exposure, or market-manipulation risk. In this context, users may trigger destructive or abusive blockchain actions with real funds and no safety framing, increasing the chance of harmful misuse.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This skill explicitly exposes wallet-drain and fund-sweeping operations such as swarm recovery and consolidation without requiring any confirmation, authorization boundary, or prominent warning about irreversible asset movement. In the context of an agent skill for automated trading, these endpoints materially increase the chance that a prompt injection, operator mistake, or compromised workflow could trigger bulk liquidation and transfer of user funds.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill describes 'vamp-all' wallet draining and 'clean funds' privacy-swap flows in a normalized, instructional way, including guidance for moving funds through other chains to 'clean' them. That combination is highly dangerous because it facilitates automated fund exfiltration, obscures transaction tracing, and lowers friction for misuse by an agent or attacker operating with the user's API key.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The examples instruct users to source a high-privilege API key from environment variables or a local config file and immediately use it for sensitive launch, trading, and fund-movement operations, but provide no guidance on secure storage, least privilege, rotation, or transmission risk. In a skill centered on financial automation, omission of credential-handling warnings materially raises the chance of accidental exposure or unsafe operational use.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This example polls positions and automatically executes full sell orders once a target multiplier is reached, without an additional confirmation step, dry-run mode, or safety interlock. That creates a real risk of unintended liquidation from logic errors, stale data, bad thresholds, or unauthorized execution in any environment where the API key is available.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The manifest advertises an automated 'volume bot' for configurable volume generation, which strongly suggests coordinated artificial trading activity, but provides no warning about market-manipulation, exchange/account sanctions, or legal/compliance risk. Given the surrounding context of swarm buys, copy trading, and wallet-drain tooling, this is more dangerous than a generic trading bot because it appears designed to facilitate abusive or deceptive market behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill offers autonomous copy trading that mirrors another wallet's trades, yet the manifest lacks warnings about financial loss, autonomous execution, slippage, and the possibility of repeated trades without meaningful user review. In an AI-agent setting, this increases the chance that users delegate live trading behavior without understanding that funds can be committed automatically and rapidly.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The README tells users to place an API key in config or environment variables but provides no warning that the credential is sensitive or guidance on secure storage. This increases the risk of accidental exposure through committed config files, shared shells, logs, screenshots, or poorly secured environments.

Static analysis

No suspicious patterns detected.