Solana CLI for trading, prediction markets, defi and x402 payments

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:44 AM UTC
• Version: 0.3.4

Overview

This skill is coherent for Solana wallet and trading use, but needs Review because it combines real fund-moving authority with mutable package execution and under-scoped paid web requests.

Install only after reviewing the CLI source or using a pinned, verified package version. Use a dedicated low-balance wallet, disable permissions you do not need, especially `canFetch` and trading/write permissions, set transaction and daily limits, use allowlists, and lock config after review. For x402, use `--dry-run` first and always set a small `--max`; do not send secrets in request bodies or headers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:38

Finding

Execution of an Unpinned Mutable npm Package with Wallet Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38-43
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

bash

Prefer `npx` with `@latest` — it always runs the latest version with no
global install to manage:

npx @solana-compass/cli@latest config set rpc.url https://your-rpc-endpoint.com
npx @solana-compass/cli@latest wallet create --name my-wallet

Technical Analysis

The Skill explicitly recommends running @solana-compass/cli@latest through npx. This downloads and executes whichever package version the npm registry currently designates as the latest release. The effective executable can therefore change after the Skill has been reviewed, without any corresponding change to this project.

No exact package version, integrity hash, lockfile, or provenance verification is supplied. This is particularly sensitive because the downloaded CLI creates and accesses wallet key files, signs blockchain transactions, and can transfer, trade, stake, lend, or otherwise control cryptocurrency.

The repository does not contain the npm package implementation, so this audit cannot establish that the current package is malicious. The vulnerability is the unsafe supply-chain trust model created by executing a mutable release with access to high-value wallet material.

Attack Path

1. An attacker compromises the npm publisher account, package build pipeline, or another mechanism controlling the latest release.
2. The attacker publishes a modified version and marks it as the latest release.
3. A user or Agent follows the documented setup command.
4. npx downloads and executes the compromised package locally.
5. The package runs with the operating-system privileges of the invoking user.
6. It can attempt to read wallet files under ~/.sol/wallets/, alter transaction recipients, sign unauthorized transactions, or access other files available to that user.

...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed package version, for example @solana-compass/cli@0.3.4.
2. Distribute and verify package integrity hashes or signed provenance before execution.
3. Use a lockfile or other immutable dependency-resolution mechanism where possible.
4. Review each new package release before updating the pinned version.
5. Run the CLI with a dedicated operating-system account or sandbox that cannot read unrelated credentials and files.
6. Use dedicated low-balance wallets for Agent-controlled activity.
7. Document the expected package publisher, registry, checksum, and update process so users can detect dependency substitution.

T09 · Insecure Skill Coding Practices

Error

• Location: references/fetch-commands.md:15

Finding

Automatic Uncapped x402 Payment Authorization for Arbitrary URLs

Content

View full analysis

Vulnerability Details

File Location: references/fetch-commands.md:15-41
Supporting Locations: SKILL.md:262-279, SKILL.md:351-353, SKILL.md:420-433
Vulnerability Type: Unsafe automatic payment behavior
Risk Level: High

Vulnerable Code

text

### How it works

1. Makes the initial HTTP request
2. If the response is not 402, prints the body and exits
3. On 402, parses payment requirements (amount, recipient, network)
4. Builds a USDC transfer transaction, partially signs it
5. Retries the request with the payment attached in a header
6. Prints the response body to stdout

The CLI handles the version negotiation automatically:
- **v1 servers**: payment goes in the `X-PAYMENT` header
- **v2 servers**: payment goes in the `PAYMENT-SIGNATURE` header
  with the full accepted requirements and resource URL

### Flags

| Flag | Default | Description |
|------|---------|-------------|
| `-X, --method <method>` | GET (or POST if body given) | HTTP method |
| `-d, --body <data>` | — | Request body (sets method to POST) |
| `-H, --header <header...>` | — | Custom headers, repeatable |
| `--max <amount>` | — | Max USDC to spend (rejects if cost exceeds) |
| `--dry-run` | — | Show payment requirements without paying |
| `--wallet <name>` | default wallet | Wallet to sign payments with |

The main Skill also states that all permissions default to enabled unless explicitly disabled. The --max spending ceiling has no default value. The documented general transaction limits do not list fetch payments among the operations they govern, and the address allowlist is documented as applying to token send, not to x402 payment recipients.

Technical Analysis

sol fetch accepts an arbitrary URL and initially contacts it without knowing whether payment will be requested. If the endpoint responds with HTTP 402, the endpoint supplies the payment amount, r ...[truncated 2732 chars]

Remediation

View remediation

Remediation Suggestions

1. Require --max for every invocation capable of making an x402 payment.
2. Set canFetch to false by default and require explicit opt-in for paid requests.
3. Separate ordinary fetching from paid fetching, such as distinct fetch and fetch-pay commands.
4. After receiving HTTP 402, display the exact amount, recipient, network, and resource URL and require a separate confirmation before signing.
5. Apply configured transaction and daily spending limits to x402 payments.
6. Add dedicated allowlists for x402 endpoint origins, payment recipients, networks, and accepted tokens.
7. Reject non-HTTPS payment endpoints and validate that redirects or resource changes cannot move payment authorization to another origin.
8. Impose a conservative built-in maximum even when the user does not provide a lower cap.
9. Bind the signed authorization to the expected origin, resource, amount, recipient, network, and a short expiration period.
10. Recommend --dry-run as the default workflow rather than an optional safety feature.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The documented rm ~/.sol/data.db command is a destructive filesystem operation that can be copy-pasted directly by users. Although intended for recovery, it can cause irreversible local data loss if run accidentally or against the wrong path, and the wallet/trading context makes users more likely to execute troubleshooting commands under pressure.

Content

Scanner excerpt · references/troubleshooting.md (reported line 146)May include surrounding context.

The SQLite database is at ~/.sol/data.db. If it becomes corrupted:

bash

rm ~/.sol/data.db

The CLI will recreate it on next run. You'll lose transaction history

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: solana-payments-wallets-trading
description: >-
  Pay people in SOL or USDC, buy and sell tokens, check prices, discover
  trending and new tokens, create and manage Solana wallets, stake SOL, earn yield
  through lending and managed vaults, borrow against collateral, set up
  DCA (dollar-cost averaging) and limit orders, provide liquidity across
  multiple DEXes, trade prediction markets, pay for APIs via x402, set up

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends running npx @solana-compass/cli@latest, which fetches and executes the newest package version at runtime. In an agent-driven, wallet-managing context, this creates a supply-chain risk where a compromised or malicious upstream release could immediately gain code execution and access to local wallet operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This second invocation repeats the same unsafe pattern: executing an unpinned package from npm at runtime. Because the tool can create wallets, send funds, and modify security settings, any malicious update could directly impact assets and configuration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The sol fetch feature is designed to send network requests and, on 402 responses, sign a USDC payment and retry with payment attached. In an agent context, this enables outbound data transmission and spending to external services, which is risky because an untrusted URL could both receive request data and induce payment.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

curl — stdout is the response body, payment info goes to stderr.

bash

sol fetch https://api.example.com/data             # auto-pays 402 responses
sol fetch https://api.example.com/data --dry-run   # show price without paying
sol fetch https://api.example.com/data --max 0.05  # spending cap in USDC

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This example continues to normalize agent-initiated requests to arbitrary external endpoints. Because the feature can automatically complete payment flows, the risk is not just transmission but financial loss and potential disclosure of request metadata to third parties.

Content

Scanner excerpt · SKILL.md (reported line 266)May include surrounding context.

bash

sol fetch https://api.example.com/data             # auto-pays 402 responses
sol fetch https://api.example.com/data --dry-run   # show price without paying
sol fetch https://api.example.com/data --max 0.05  # spending cap in USDC

sol fetch https://api.example.com/rpc \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The POST example shows arbitrary request bodies being sent to remote endpoints. In a tool that may be used by autonomous agents, this increases the chance of exfiltration of sensitive context or unintended payment-triggering interactions with attacker-controlled services.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

bash

sol fetch https://api.example.com/data             # auto-pays 402 responses
sol fetch https://api.example.com/data --dry-run   # show price without paying
sol fetch https://api.example.com/data --max 0.05  # spending cap in USDC

sol fetch https://api.example.com/rpc \
  -X POST -d '{"query":"..."}' \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This example reinforces arbitrary outbound HTTP requests with custom headers, broadening the external interaction surface. Combined with automatic payment handling and wallet signing, it can be abused for data exfiltration, billing abuse, or interaction with hostile infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

sol fetch https://api.example.com/data --dry-run # show price without paying sol fetch https://api.example.com/data --max 0.05 # spending cap in USDC

sol fetch https://api.example.com/rpc
-X POST -d '{"query":"..."}'
-H "Accept: application/json" # POST with headers

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The text at L442-L446 says agents should use sol config status rather than reading config.toml directly and should never interact with key/config files except through CLI commands. However, earlier sections explicitly have agents change permissions, limits, allowlists, and lock state through sol config set and sol config lock, which are direct modifications of the protected security configuration. This is an intent/documentation contradiction about what agent interaction with the protected configuration should be.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 446)May include surrounding context.

md

### Important: Filesystem Access

**Do not grant agents read or write access to `~/.sol/`.** This directory contains your private keys and security configuration. Agents should only interact with Solana through the `sol` CLI commands, never by reading config or key files directly. After helping set up security, recommend the user lock settings with `sol config lock` and restrict filesystem access to `~/.sol/`.

## Security Model

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation explicitly states that sol fetch will automatically pay on HTTP 402 and that the wallet will partially sign a transaction, but it does not present a prominent safety warning near the feature description. In a wallet/trading skill, this can normalize spending to arbitrary remote endpoints and increase the chance that users trigger real on-chain payments without fully understanding the trust and cost implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 47)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 50)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 53)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 56)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 62)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 70)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 73)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-commands.md (reported line 125)May include surrounding context.

bash

# Simple GET — auto-pays if 402
sol fetch https://api.example.com/data

# Check the price before paying
sol fetch https://api.example.com/data --dry-run

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation presents lending actions like deposit, withdraw, borrow, and repay as straightforward CLI operations without prominent warnings that they trigger real on-chain transactions, may be irreversible once signed, and can expose users to liquidation, slippage, smart-contract, and protocol-selection risk. In a wallet and trading skill, this omission can cause users to take financially significant actions with insufficient understanding, especially because the CLI auto-selects protocols and supports leverage-like borrowing flows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The deposit documentation describes commands that execute real on-chain liquidity actions, including implicit internal swaps for single-sided deposits and protocol-selected default CLMM ranges, but it does not prominently warn users that these defaults can immediately expose them to slippage, bad range placement, and irreversible asset conversion. In a wallet/trading skill, omission of such warnings is dangerous because users may treat examples as routine and commit funds without understanding that value loss can occur at execution time even if the command syntax is correct.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The withdraw documentation states the default behavior but does not elevate it as a prominent risk warning: running the command with no flags withdraws 100%, closes the position, and can realize impermanent loss and P&L irreversibly. In the context of a command-line wallet/trading tool, users may copy-paste examples or assume a preview/safe default, causing unintended full exits from positions and loss of future fee accrual.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Pool creation is a high-risk capital action, especially for new or illiquid pairs, yet the documentation lacks an explicit warning that funds are being committed on-chain and that creation fees and initial pricing mistakes may not be recoverable. In this skill's DeFi context, unclear guidance around pool creation can mislead users into launching pools with mispriced assets, stranded liquidity, or unexpected fees.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented buy command is a write action that spends real USDC, but the section presents it like a routine CLI operation without an explicit warning that funds will be committed and losses may be irreversible. In a wallet/trading skill, omission of a prominent financial-risk warning increases the chance of accidental or uninformed trades, especially when example commands are directly copyable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The sell and claim commands trigger state-changing asset actions, but the documentation does not clearly warn users that these operations can realize losses, move assets, or be irreversible once submitted. Because this skill is specifically for wallets and trading, understated risk around write actions is more dangerous: users are likely to treat command examples as safe operational guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.