ClawHub
Back to skill

Security audit

Create a coin on trends.fun

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real trends.fun coin-creation tool, but it handles Solana wallet secrets and mainnet transactions with unsafe disclosure and confirmation gaps.

Review this before installing if the wallet holds meaningful funds. Use a fresh low-balance Solana keypair, do not allow the agent to print or paste private key material into chat/logs, verify every mainnet transaction manually, avoid --first-buy until slippage protection is added, and update/pin dependencies before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
src/pool.ts:61
Finding

Initial Token Purchase Executes Without Slippage Protection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
src/auth.ts:15
Finding

SIWS Authentication Uses a Predictable Non-Cryptographic Nonce

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (42)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documentation does not clearly foreground that the workflow performs wallet-based authentication using a private key to sign messages and obtain a bearer token. Hidden or understated signing and token issuance behavior is dangerous because users may authorize identity-bearing operations without understanding they are logging into a remote service.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The documentation does not clearly foreground that the workflow performs wallet-based authentication using a private key to sign messages and obtain a bearer token. Hidden or understated signing and token issuance behavior is dangerous because users may authorize identity-bearing operations without understanding they are logging into a remote service.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The documentation does not clearly foreground that the workflow performs wallet-based authentication using a private key to sign messages and obtain a bearer token. Hidden or understated signing and token issuance behavior is dangerous because users may authorize identity-bearing operations without understanding they are logging into a remote service.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instruction to output the user's Solana keypair and address would expose highly sensitive wallet secret material in plaintext. Disclosure of the private key allows complete compromise of the wallet, including theft of funds, impersonation, and irreversible unauthorized blockchain transactions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile includes bigint-buffer 1.1.5, which is flagged for a buffer overflow in toBigIntLE(). Even though this package is transitive, memory-unsafe native/binary-adjacent parsing bugs in dependency chains are real supply-chain risks, especially in a crypto/serialization-heavy Solana stack where attacker-controlled binary data may be processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
93% confidence
Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/values. This skill appears to create coins and may upload metadata or interact with remote APIs, so if attacker-controlled names or metadata fields are inserted into multipart requests, request smuggling/header injection against upstream services could become possible.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
92% confidence
Finding

ws 8.19.0 is present with advisories for uninitialized memory disclosure and memory-exhaustion DoS. If any dependency opens websocket connections to RPC or external services and handles attacker-influenced websocket traffic, these flaws could leak process memory or crash the process through resource exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: toml==3.0.0 — 2 advisory(ies): CVE-2026-77465 (toml-node: Uncontrolled Recursion); CVE-2026-63376 (toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__pro)

High
Category
Supply Chain
Confidence
95% confidence
Finding

toml 3.0.0 is flagged for uncontrolled recursion and prototype pollution. Because Anchor-related tooling uses toml, malicious TOML configuration content could potentially cause denial of service or object prototype corruption if untrusted TOML is ever parsed in build/runtime workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
90% confidence
Finding

ws 7.5.10 is also present and vulnerable to memory-exhaustion DoS from fragmented chunks. Since this older websocket version is brought in through jayson, any reachable JSON-RPC/websocket functionality handling untrusted peers could be crashed or degraded through crafted traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High
Category
Supply Chain
Confidence
98% confidence
Finding

bigint-buffer 1.1.5 is flagged with a buffer overflow advisory in toBigIntLE(), which can lead to process crashes or potentially memory corruption depending on how the library is exercised. In a blockchain CLI handling untrusted on-chain or user-supplied binary data, this is more concerning because malformed inputs may be processed during transaction or key material handling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
94% confidence
Finding

The installed form-data version is reported vulnerable to CRLF injection through unescaped multipart field names and values, which can enable request smuggling or header/body manipulation when attacker-controlled fields are submitted. This skill's purpose includes coin creation and likely metadata upload or API interaction, so multipart form construction may be reachable and the context makes the issue more relevant.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill requires shell execution, network access, and environment interaction, but it does not declare any explicit tool scope or permissions boundaries. That makes the skill harder to review and can lead an agent runtime to grant broader capabilities than a user expects for a workflow that also signs blockchain messages and spends real funds.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 2)May include surrounding context.

md
---
name: trends-coin-create
description: 在 trends.fun 上创建 coin 并部署 Meteora DBC 资金池
metadata:
  {

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language content of the skill, including the description, prerequisites, usage guidance, and cautions, is written entirely in Chinese. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience, which creates a language policy concern.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

Using npx tsx without a pinned version allows resolution of whatever package version is current at execution time, creating supply-chain risk and reducing reproducibility. In a skill that handles Solana key material and performs authenticated blockchain operations, an unexpected package update could introduce malicious code or break safety assumptions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The second npx tsx invocation has the same unpinned-package problem: execution depends on an external package version fetched or resolved at runtime. Because this skill interacts with wallets, remote authentication, and token creation, the trust boundary is too sensitive for floating tool versions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The dev script invokes npx tsx, which can resolve and execute packages from a registry context rather than strictly using a repository-pinned binary. In a security-sensitive skill that may handle blockchain transactions and keys, this increases supply-chain risk because an unexpected or substituted tsx version could be executed during development or local testing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/api.ts (reported line 5)May include surrounding context.

ts
import * as path from "path";
import FormData from "form-data";

const API_BASE = "https://api.trends.fun/v1";

/**
 * 通用请求头

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/auth.ts (reported line 58)May include surrounding context.

ts
import * as path from "path";
import FormData from "form-data";

const API_BASE = "https://api.trends.fun/v1";

/**
 * 通用请求头

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The request header hard-codes x-lang to zh-CN, which imposes a specific language/locale for all API calls. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code accepts a full Keypair, uses keypair.secretKey to sign a login message, and transmits the signed payload to a remote verification endpoint. Although there are console logs for login progress, there is no explicit user disclosure or confirmation that a locally held wallet secret key will be used for authentication against an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/auth.ts (reported line 58)May include surrounding context.

ts
console.log("🔐 正在进行 SIWS 签名登录...");

    // 调用 verify 接口
    const resp = await fetch("https://api.trends.fun/v1/siws/verify", {
        method: "POST",
        headers: {
            "Content-Type": "application/json",

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill automatically loads the user's Solana private key from ~/.config/solana/id.json, which is a sensitive credential source not disclosed in the skill description. In the context of a tool that creates on-chain assets and pools, this enables immediate signing authority over the user's wallet and could lead to unauthorized transactions or fund loss if the skill behavior is modified or misunderstood.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code creates a blockchain pool and may spend SOL via the first-buy path without any explicit confirmation, dry-run, or strong warning about irreversible on-chain effects. Because it already auto-loads a local keypair, a user can unintentionally authorize real mainnet transactions and lose funds with a single command invocation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bn.js==5.2.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low
Category
Supply Chain
Confidence
87% confidence
Finding

bn.js 5.2.2 is present and reported as vulnerable to an infinite loop. In this project's blockchain context, large-number parsing and arithmetic are common, so malformed or adversarial numeric inputs could trigger denial of service if they reach affected operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.