Security audit

Solana Trading Api

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Solana trading skill, but its reference client can sign and submit remote-built transactions with a wallet key without checking the transaction contents.

Install only if you are comfortable giving a local process signing authority over a dedicated, low-balance Solana trading wallet. Keep dry-run enabled until reviewed, avoid using a primary wallet, and add local transaction validation or human confirmation before live signing.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:879
Finding: Server-Supplied Solana Transactions Are Signed Without Semantic Validation
Content: View full analysis
0 && triggered_mcap != null && triggered_mcap / filled_mcap < 0.85) { log({ step: 'order_fill_skipped', order_id, reason: 'stale', triggered_mcap, filled_mcap }); return; } const signedBase64 = signVersionedTx(swap_tx); const result = await submitTx(signedBase64, { token: token_address, action ...[truncated 3194 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill enables irreversible on-chain swaps and order execution using a wallet identity, yet the top-level description lacks a prominent user-facing risk warning about live trading, slippage, loss of funds, and transaction finality. In an agent setting, this increases the chance that a user authorizes actions without understanding that trades are financial operations that cannot be undone.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.
md
Return market cap (and optional price/pool) for given token addresses. **Request:** `GET https://api.traderouter.ai/mcap?tokens=MINT1,MINT2` (comma-delimited Solana mint addresses). **Response:** Object keyed by token address. Each value can include `marketCap`, `pair_address`, `pool_type`, `priceUsd`. Empty object if no tokens provided or none found.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
Return market cap (and optional price/pool) for given token addresses. **Request:** `GET https://api.traderouter.ai/mcap?tokens=MINT1,MINT2` (comma-delimited Solana mint addresses). **Response:** Object keyed by token address. Each value can include `marketCap`, `pair_address`, `pool_type`, `priceUsd`. Empty object if no tokens provided or none found.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 472)May include surrounding context.
md
Return market cap (and optional price/pool) for given token addresses. **Request:** `GET https://api.traderouter.ai/mcap?tokens=MINT1,MINT2` (comma-delimited Solana mint addresses). **Response:** Object keyed by token address. Each value can include `marketCap`, `pair_address`, `pool_type`, `priceUsd`. Empty object if no tokens provided or none found.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes the skill as operating through the TradeRouter API, specifically citing REST /swap, /holdings, /protect and the TradeRouter WebSocket. However, the reference client includes a direct fallback path that submits transactions to an arbitrary Solana RPC endpoint with sendRawTransaction/confirmTransaction, which is a distinct execution channel outside the declared API surface.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest says the skill supports REST endpoints POST /swap, POST /holdings, POST /protect, and the WebSocket for limit orders, but the file also documents GET /mcap and GET /flex as supported use cases. This creates a description/behavior mismatch because the actual documented skill scope is broader than the manifest's enumerated interface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The main WebSocket documentation repeatedly states registration is challenge-response only and requires signing the server nonce with the wallet private key before authenticated use. But the definition-of-done TWAP checklist shortens this to 'connect → register', which contradicts the documented required authentication sequence for placing orders.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The surrounding documentation explains that WebSocket registration succeeds only when the client signs the challenge nonce with the wallet private key. In preflight, an unauthenticated registration failure is reported as 'check server signature', which contradicts the actual mechanism and could mislead operators about what failed.
Content: No source excerpt is available for this finding.