Security audit

Solana Funding Rate Arbitrage

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Solana auto-trading skill, but its live-trading safeguards are weak enough that users should review it carefully before installing.

Only install this if you are prepared to audit and modify it before any live use. Keep dry_run enabled in the config, do not rely on the trade:dry command alone, avoid storing a raw private key in a sourced shell file, do not add the cron job until the environment loading is hardened, and treat the live auto-trader as unsafe until it fails closed on bad market data and has complete two-leg execution with rollback.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/src/trading/drift-client.ts:101
Finding: Live Trading Can Use Fabricated Fallback Market Data
Content: View full analysis
({ marketIndex: m.index, symbol: m.symbol, oraclePrice: m.price, markPrice: m.price, fundingRate: m.rate, fundingRateApy: m.rate * 24 * 365 * 100, openInterest: 10000000, volume24h: 50000000 })); } ``` ```ts // scripts/src/trading/flash-client.ts:89-143 try { const response = await axios.get( `${COINGECKO_API}/derivatives/exchanges/flash_trade`, { timeout: 10000 } ); if (!response.data?.tickers) { throw new Error('No ticker data'); } // Live response processing omitted } catch (error: any) { logger.warn(`Flash API error: ${error.message}`); return this.getBackupMarketData(); } private getBackupMarketData(): FlashMarketInfo[] { return [ { symbol: 'SOL-PERP', oraclePrice: 185, fundingRate: 0.0008, fundingRateApy: 700, openInterest: 5000000, volume24h: 20000000 }, { symbol: 'BTC-PERP', oraclePrice: 98000, fundingRate: 0.0003, fundingRateApy: 262, openInterest: 10000000, volume24h: 50000000 }, { symbol: 'ET ...[truncated 2712 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/src/trading/auto-trader.ts:92
Finding: Advertised Dry-Run Controls Do Not Override Live Configuration
Content: View full analysis
&1 | tee -a $LOG_FILE ``` ```ts // scripts/src/trading/auto-trader.ts:92-127 private loadConfig(): TraderConfig { try { if (fs.existsSync(CONFIG_PATH)) { const data = fs.readFileSync(CONFIG_PATH, 'utf-8'); const loaded = JSON.parse(data); logger.info(`Config loaded from ${CONFIG_PATH}`); return loaded; } } catch (error: any) { logger.warn(`Config load error: ${error.message}`); } // Default config return { strategy: 'ultra_safe', max_position_pct: 50, min_spread: 0.5, max_dd_pct: 2, auto_execute: true, dry_run: true, leverage: 1, check_interval_hours: 4, min_apy_threshold: 100, max_position_usd: 100, notification: { telegram: true, on_open: true, on_close: true, on_funding: true }, risk: { max_positions: 2, stop_loss_pct: 2, take_profit_pct: null, auto_rebalance: true, rebalance_threshold: 0.3 } }; } ``` ### Technical Analysis The `trade:dry` command and dry-run shell script set `DRY_RUN=true`, giving users a clear expectation that trading is simulated. However, `loadConfig()` never reads `process.env.DRY_RUN`. When `~/.secrets/funding-arb-config.json` exists, its contents are returned directly. A persisted value of `"dry_run": false` therefore overrides the user's apparent selection of the dry-run command. The environment variable has no effect. This is particularly dangerous because wallet init ...[truncated 1236 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/src/trading/auto-trader.ts:299
Finding: Sequential Two-Leg Execution Can Leave an Unhedged Live Position
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cron-runner.sh:4
Finding: Scheduled Runner Executes Arbitrary Shell Content from Shared Secrets File
Content: View full analysis
Create `.env` in scripts directory or `~/.secrets/.env`: ```env # Required for live trading SOLANA_PRIVATE_KEY=[1,2,3,...] # Or use wallet file SOLANA_WALLET_PATH=/path/to/wallet.json # Optional SOLANA_RPC_URL=https://mainnet.helius-rpc.com/?api-key=YOUR_KEY DEBUG=true # Verbose logging ``` ## Cron Setup Run every 4 hours: ```bash # Add to crontab -e 0 */4 * * * ~/clawd/skills/solana-funding-arb/scripts/cron-runner.sh ``` ``` ### Technical Analysis Bash `source` does not parse a file as passive environment data. It executes the file as shell code in the current process. Consequently, `~/.secrets/.env` can contain command substitutions, function definitions, redirections, or arbitrary commands, all of which run before the trader. The documentation recommends placing a highly sensitive Solana private key in this shared file and running the loader through cron every four hours. The schedule itself is explicit, user-installed, and relevant to the declared automated-trading functionality; therefore, it is not a covert backdoor. However, combining recurring execution with an executable shared secrets file unnecessarily broadens the trust boundary and increases the consequences of file modification. The code does not verify ownership, permissions, file type, or symbolic-link status before sourcing the file. ### Attack Path ...[truncated 1295 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (142)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This finding suggests some chunks are only type definitions or utilities unrelated to the advertised strategy, reinforcing that the published description overstates cohesive functionality. While less directly dangerous than secret handling, it still contributes to misleading operators about what is production-ready.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/src/dashboard/server.ts:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/src/protocols/drift.ts:13

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/src/trading/drift-client.ts:74

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/src/trading/flash-client.ts:68