Solana Trading Api

• Analyzed: May 12, 2026, 4:16 AM
• Findings: 1
• Version: 1.3.0
• Hash: 561ca4b1ef8bfa988c1934fcbf88362b4b1258b3229ce68d33805ceeeac8c3c8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'trade-router' skill bundle provides a Solana trading interface that requires access to a wallet's private key via the 'PRIVATE_KEY' environment variable to sign transactions locally. While the skill includes robust safety features—such as a default dry-run mode, daily loss limits, and server-side signature verification—it involves high-risk capabilities including financial transaction submission to an external API (api.traderouter.ai) and sensitive credential handling. These behaviors are plausibly necessary for the stated purpose of a trading bot but meet the threshold for a suspicious classification due to the inherent risks of private key exposure and third-party transaction routing.