Security audit

Carbium — Solana DeFi Infrastructure

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent Carbium/Solana developer documentation, but it needs Review because it teaches live wallet signing and trading flows with insufficient validation and safety boundaries.

Use this only for deliberate Solana infrastructure or trading work. Keep Carbium keys and wallet keys server-side, prefer header authentication when supported, never let an agent sign or submit transactions automatically, inspect and validate every transaction before signing, and test with unfunded or small-balance wallets before mainnet use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: examples/swap-quote/README.md:57
Finding: Remote transactions are signed without validating their instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: templates/carbium-setup.ts:23
Finding: API credentials are embedded in request URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: examples/swap-bundle/README.md:63
Finding: Signed bundle transactions are transmitted in a GET query parameter
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documents and encourages use of environment variables and outbound network access, but its front matter does not declare any explicit tool scope such as allowed-tools or permissions. In an agent setting, this ambiguity can cause overbroad runtime capabilities, making it easier for an agent to access secrets or call external services without clear policy review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The pump.fun sniping section provides detailed instructions for rapid speculative trading, including skipPreflight usage and low-latency execution, but does not prominently warn that this is high-risk, irreversible financial behavior. In an agentic context, that omission can lead users or autonomous workflows to execute unsafe trades without sufficient human confirmation or risk controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README includes example code that performs a real SOL transfer but does not warn users that blockchain transactions are irreversible and may move mainnet funds if run with a funded keypair. In developer documentation, omission of this safety context can lead to accidental asset loss, especially when readers copy-paste examples without understanding the financial consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The example signs a transaction locally and then transmits the fully signed transaction to a remote bundle endpoint, but the README does not explicitly warn users that they are authorizing external submission and relay of that signed payload. While this is expected for Jito-style bundling, a signed transaction is an authorization artifact that can be submitted by the remote service, so the documentation should make that trust boundary explicit.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The example places the signed transaction into the URL query string when submitting to the remote bundle endpoint. Query strings are commonly logged by clients, proxies, CDNs, server access logs, browser/dev tooling, and monitoring systems, so this increases the exposure of a reusable signed transaction and makes the external transmission materially more dangerous.
Content: Scanner excerpt · examples/swap-bundle/README.md (reported line 64)May include surrounding context.
md
// Step 3: Submit via Jito bundle (v1 endpoint) async function submitBundle(signedBase64: string) { const url = new URL("https://api.carbium.io/api/v1/swap/bundle"); url.searchParams.set("signedTransaction", signedBase64); const res = await fetch(url, {

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README demonstrates a complete flow that signs and submits a real swap transaction on Solana, but it does not prominently warn users that running the example will execute an actual on-chain trade with real funds if a live key is supplied. In documentation for financial operations, this omission is risky because users may copy-paste the example, misunderstand it as a dry-run quote example, and unintentionally authorize asset movement and incur loss or fees.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation explicitly instructs users to place the API key in a WebSocket URL query string. Query-string credentials are commonly exposed through logs, browser history, proxies, monitoring systems, error reports, and shared connection metadata, increasing the chance of credential leakage even when TLS is used. In this skill's infrastructure context, leaked keys could enable unauthorized use of paid RPC/gRPC resources and visibility into a user's blockchain data flows.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 530)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 561)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 575)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 591)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 629)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 709)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 1103)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/migration.md (reported line 123)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/trading-bots.md (reported line 43)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/gasless-swap/README.md (reported line 32)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/swap-bundle/README.md (reported line 36)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · examples/swap-quote/README.md (reported line 29)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/endpoints-and-auth.md (reported line 11)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/endpoints-and-auth.md (reported line 22)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/swap-api-reference.md (reported line 9)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/swap-api-reference.md (reported line 10)May include surrounding context.
md
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · templates/carbium-setup.ts (reported line 39)May include surrounding context.
ts
| Version | Base URL | Parameters | Status | |---|---|---|---| | **v2 (Q1)** | `https://api.carbium.io/api/v2` | `src_mint`, `dst_mint`, `amount_in`, `slippage_bps` | **Current** | | v1 (legacy) | `https://api.carbium.io/api/v1` | `fromMint`, `toMint`, `amount`, `slippage` | Operational, legacy | > **Do not mix parameter families across versions.** Sending `fromMint` to a v2 endpoint or `src_mint` to a v1 endpoint will fail or return bad results.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: templates/carbium-setup.ts:16