Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly transparent, but its Solana instructions let the agent relay a signed transaction despite claiming it only prepares unsigned transactions and never moves funds.
Review before installing. This skill may be acceptable only if you are comfortable with Chord receiving and broadcasting signed Solana transactions. For a stricter non-custodial boundary, the Solana send step should be removed or clearly disclosed with explicit user control, and users should broadcast signed transactions through their own wallet instead.
The examples state that after the user signs a Solana transaction, the agent submits the signed transaction to an external API and then tracks the resulting on-chain transaction. This contradicts the stated boundary that the skill only returns unsigned transactions, and expands the agent from an informational/preparation role into active execution of fund-moving actions.
The documentation explicitly describes the agent submitting a signed Solana transaction despite the manifest claiming it only returns unsigned transactions. This kind of scope mismatch is dangerous because users, reviewers, and policy gates may trust the narrower manifest while the actual documented behavior enables transaction execution.
The Solana instructions explicitly tell the agent to submit a signed transaction to Chord's /send endpoint after the user signs it. That contradicts the skill metadata stating it only returns unsigned transactions and never moves funds, meaning the skill as documented can complete a live asset-moving swap rather than stopping at quote generation.
The documented workflow extends beyond generating an unsigned transaction and instructs transmission of a user-signed Solana transaction to an external API for execution. This safety-model mismatch is dangerous because users or higher-level systems may rely on the manifest's claim that the skill cannot move funds, while the reference enables exactly that behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
the zero address. 100 USDC = `100000000`.
2. Safety check: not needed for the native coin.
3. Price quote:
`GET https://api.getchord.xyz/v1/meta/quote?chain=base&tokenIn=0x833589fcd6edb6e08f4c7c32d4f71b54bda02913&tokenOut=0x0000000000000000000000000000000000000000&amount=100000000`
→ `provider: "chord"`, `amountOut` about 0.0411 ETH, price impact 0.00 %.
4. The agent answers:
The example says the agent checks the receipt and provides an explorer link after the wallet sends the approval and swap transactions. While less severe than submitting a signed transaction itself, this still exceeds the documented scope of quoting and returning unsigned transactions and implies post-execution monitoring of user activity.
At this line, the example has the agent POST a signed Solana transaction to an external endpoint for broadcast. Sending a user-signed transaction to a third party for execution is materially more sensitive than normal quote retrieval and enables the skill to directly cause on-chain state changes, contrary to the stated trust boundary.
→ `quote.route` `direct` (Orca) or `jupiter`, `outAmount` and `minOut` in BONK's smallest unit.
4. Summary, then wait for the user's yes in a later message.
5. The user's wallet signs `quote.tx` unchanged; the agent sends it with
`POST https://api.getchord.xyz/v1/sol/trade/send` `{"tx": "<signed, base64>"}` and links
`https://solscan.io/tx/<signature>`.
This endpoint sends a signed Solana transaction blob to Chord for broadcast, enabling the skill to move user funds on-chain once a signature is obtained. In context, this is more dangerous because the skill metadata expressly claims it never moves funds and only returns unsigned transactions, so the external transmission is not just informational but an execution step hidden behind contradictory safety claims.
The user's wallet signs `quote.tx` unchanged (any change and Chord refuses it). Then:
`POST https://api.getchord.xyz/v1/sol/trade/send` with JSON body `{"tx": "<signed transaction, base64>"}`
The answer has `signature` and `status` (`pending`, `confirmed`, `finalized`, `failed`, `expired`),
plus `receivedOut` once it landed. Errors: `UNKNOWN_TRANSACTION` (older than three minutes, or changed
No suspicious patterns detected.