Poseidon OTC

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:03 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Solana OTC trading skill, but it gives an agent hot-wallet authority to move funds through Poseidon services without built-in approval limits.

Install only if you intentionally want an agent to operate a dedicated, low-balance Solana burner wallet for OTC swaps. Do not use a primary wallet key. Require manual approval for every deposit, confirmation, receive-wallet change, lockup, claim, cancellation, and execution; verify token mints, amounts, room IDs, counterparties, and recipient wallets outside the Poseidon API before signing or executing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill requires a private key from the environment and clearly performs outbound HTTP/WebSocket interactions, but it does not declare corresponding permissions/capabilities in a structured way. This weakens sandboxing and review, making it easier for an agent platform or user to underestimate the skill's ability to access secrets and move funds via networked services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is presented as trustless and on-chain, but the documented flow depends on centralized Poseidon backend and relayer services for room lifecycle, execution, cancellation, claiming, and state updates. That mismatch can mislead users and autonomous agents into granting trust assumptions they would not otherwise accept, creating risks of censorship, manipulation, availability failure, or unsafe automated fund movement based on off-chain state.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest markets the skill as 'trustless' while the body documents reliance on Poseidon API, WebSocket infrastructure, and a relayer endpoint. Even if escrow settlement is on-chain, hiding or downplaying service dependencies can cause operators to misjudge security boundaries and expose funds or trading decisions to centralized control and outage risk.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README encourages autonomous operation by supplying a raw base58 private key directly to the client and shows trade-execution calls without clearly foregrounding that these actions can move funds irreversibly on mainnet. In the context of a crypto trading skill, this materially increases the chance that users or agents will load a hot wallet and trigger unintended on-chain actions, especially since the skill supports escrow deposits and swap confirmation flows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The autonomous agent-to-agent examples show agents confirming and executing swaps automatically with a hot wallet, but they do not include safeguards such as human approval, spending limits, allowlists, or slippage/value checks. In a financial skill handling irreversible token transfers, this materially increases the chance of accidental or adversarially induced loss through bad offers, spoofed counterparties, logic errors, or manipulated event-driven execution.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: updateOffer/depositOnchain can autonomously create token accounts, wrap SOL, transfer funds, and submit signed on-chain transactions whenever a burner key is configured, with no built-in confirmation gate, policy check, or spend limit. In an agent setting, this materially increases the risk of unintended asset movement from prompt injection, bad automation, or operator misunderstanding.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: withdrawOnchain submits signed withdrawal transactions automatically and derives token program/account behavior dynamically from chain state without any user-facing confirmation step. While withdrawals may return funds to the user, they still perform privileged asset-moving actions that an autonomous agent should not execute silently.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: cancelRoom sends highly sensitive identity secrets, including partyAIdentitySecret, to a remote API endpoint so the server/relayer can perform cancellation. Those secrets appear to function as ownership proofs for on-chain operations, so exposing them to a centralized service expands trust assumptions and could enable unauthorized cancellation or other actions if the API, logs, or transport handling are compromised.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: claimLockedTokens triggers a remote API request that can move assets based on the provided identitySecret, without an explicit confirmation step or policy guard. In this skill's autonomous context, the absence of consent controls makes accidental or adversarially induced asset actions more likely.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: executeSwap performs the final irreversible exchange through a remote API using room state fetched from the backend, without explicit local authorization, destination-account verification by the user, or any confirmation barrier. In an autonomous agent environment, this is especially dangerous because a compromised backend, manipulated room metadata, or injected instruction to call execute can result in irreversible loss or misdirection of assets.

Known Vulnerable Dependency: @solana/web3.js==1.87.6 — 1 advisory(ies): CVE-2024-30253 (Handling untrusted input can result in a crash, leading to loss of availability )

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: @solana/web3.js==1.87.6

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/index.ts:29