Security audit

solana-bundler-sniper-volume-bot

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly a crypto trading agent, but it gives an agent broad live trading, wallet-draining, volume-generation, and fund-routing powers without enough safety controls or warnings.

Install only if you intentionally want an agent to control real crypto trading and wallet operations through GANK. Use test wallets first, keep the API key out of prompts/logs, prefer tightly scoped or low-balance keys if available, and require manual confirmation before any buy, sell, transfer, sweep, wallet drain, privacy route, copy-trade, or volume-bot action.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

other

Error

Location: SKILL.md:181
Finding: Coordinated Market Manipulation and Fund Obfuscation Capabilities
Content: View full analysis
r.json()) ``` ### Technical Analysis The Skill exposes coordinated simultaneous purchases across multiple wallets, automated volume-generation sessions, complete wallet draining, and privacy-oriented cross-chain routing into fresh destination wallets. These are not merely passive market-data or ordinary single-wallet trading operations. The combined w ...[truncated 1850 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples.md:187
Finding: Destructive Wallet Operations Execute Without Adequate Safety Controls
Content: View full analysis
r.json()) const swarmAddresses = (walletsRes.swarm || []).map((w: any) => w.wallet_address) if (swarmAddresses.length === 0) { console.log('No swarm wallets to recover from.') return } // vamp all: sells tokens + closes accounts + sweeps sol const vampRes = await fetch(`${API}/wallets/vamp-all`, { method: 'POST', headers, body: JSON.stringify({ source_wallets: swarmAddresses, destination_wallet: destinationWallet, }), }).then(r => r.json()) console.log('Recovery complete:', vampRes) return vampRes } ``` The automated selling example also liquidates entire positions during a recurring polling loop: ```typescript if (currentMultiplier >= targetMultiplier) { console.log(`Selling ${pos.token_symbol} at ${currentMultiplier.toFixed(2)}x`) const sellRes = await fetch(`${API}/phases/regular/sell`, { method: 'POST', headers, body: JSON.stringify({ wallet_address: pos.wallet_address, token_mint: pos.token_mint, sell_percentage: 100, slippage_bps: 500, }), }).then(r => r.json()) console.log('Sell result:', sellRes) } // poll every 30 seconds setInterval(monitorAndSell, 30_000) ``` ### Technical Analysis The recovery example enumerates every swarm wallet and submits all addresses to an endpoint documented as selling tokens, closing accounts, and sweeping SOL. The destination is accepted directly from the caller without validation or allowlisting. The examples do not require interactive confirmation, display a transaction preview, impose value limits, verify that the destination belongs ...[truncated 1448 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:6
Finding: Unpinned Third-Party Installation Command Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: These examples implement automated 'swarm buy' and 'volume bot' behaviors that are characteristic of coordinated market-manipulation activity rather than ordinary wallet management. In the context of a token-launch/trading skill, this materially increases the risk of abuse for wash trading, artificial price/volume inflation, and user harm, and the documentation normalizes such misuse by providing ready-to-run code.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The bulk recovery example invokes an endpoint that sells tokens, closes accounts, and sweeps funds from multiple wallets to a destination address in one step. If triggered mistakenly, by compromised credentials, or with an attacker-controlled destination, it can rapidly cause irreversible asset liquidation and transfer across all swarm wallets.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: These examples describe irreversible actions including liquidation, account closure, sweeping funds, and automated selling, but they do not prominently warn users about financial loss, automation risk, or the consequences of running the code unattended. In this context, the lack of warnings makes dangerous actions appear routine and increases the likelihood of accidental self-harm or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest explicitly advertises 'transfer, split, consolidate, and drain wallets' plus privacy-routing behavior, but provides no user-facing warning about irreversible fund movement, authorization requirements, or the risk of total asset loss. In an agent skill context, exposing destructive wallet operations without strong consent and safety language makes accidental or abusive execution materially more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx skills add pissdart/gank without pinning a version, which can fetch whatever package/version is current at execution time. That creates a supply-chain risk where users may install unexpected or malicious code if the upstream package or dependency chain changes or is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README advertises high-risk wallet and token operations such as launching tokens, swarm buying, volume bots, fund cleaning, and wallet draining-like actions without any warning about financial loss, irreversible transactions, legal/compliance exposure, or market-manipulation risk. In this context, users may trigger destructive or abusive blockchain actions with real funds and no safety framing, increasing the chance of harmful misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill explicitly exposes wallet-drain and fund-sweeping operations such as swarm recovery and consolidation without requiring any confirmation, authorization boundary, or prominent warning about irreversible asset movement. In the context of an agent skill for automated trading, these endpoints materially increase the chance that a prompt injection, operator mistake, or compromised workflow could trigger bulk liquidation and transfer of user funds.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill describes 'vamp-all' wallet draining and 'clean funds' privacy-swap flows in a normalized, instructional way, including guidance for moving funds through other chains to 'clean' them. That combination is highly dangerous because it facilitates automated fund exfiltration, obscures transaction tracing, and lowers friction for misuse by an agent or attacker operating with the user's API key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The examples instruct users to source a high-privilege API key from environment variables or a local config file and immediately use it for sensitive launch, trading, and fund-movement operations, but provide no guidance on secure storage, least privilege, rotation, or transmission risk. In a skill centered on financial automation, omission of credential-handling warnings materially raises the chance of accidental exposure or unsafe operational use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This example polls positions and automatically executes full sell orders once a target multiplier is reached, without an additional confirmation step, dry-run mode, or safety interlock. That creates a real risk of unintended liquidation from logic errors, stale data, bad thresholds, or unauthorized execution in any environment where the API key is available.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest advertises an automated 'volume bot' for configurable volume generation, which strongly suggests coordinated artificial trading activity, but provides no warning about market-manipulation, exchange/account sanctions, or legal/compliance risk. Given the surrounding context of swarm buys, copy trading, and wallet-drain tooling, this is more dangerous than a generic trading bot because it appears designed to facilitate abusive or deceptive market behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill offers autonomous copy trading that mirrors another wallet's trades, yet the manifest lacks warnings about financial loss, autonomous execution, slippage, and the possibility of repeated trades without meaningful user review. In an AI-agent setting, this increases the chance that users delegate live trading behavior without understanding that funds can be committed automatically and rapidly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README tells users to place an API key in config or environment variables but provides no warning that the credential is sensitive or guidance on secure storage. This increases the risk of accidental exposure through committed config files, shared shells, logs, screenshots, or poorly secured environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.