solana-sniper-bot

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill calls the Jupiter swap endpoint at https://quote-api.jup.ag/v6/swap at runtime and uses the returned swapTransaction (base64) to construct, sign, and broadcast a transaction — i.e., remote content directly determines executable on-chain actions.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to execute cryptocurrency trades. It requires a Solana private key, RPC/Helius, and configures BUY_AMOUNT_SOL, TAKE_PROFIT, STOP_LOSS, etc. The README states it "executes buy/sell orders via Jupiter aggregator", performs "Auto-Buy" and "Auto-Sell", and manages positions (TP/SL). These are specific crypto/blockchain transaction capabilities (wallet signing and swaps) and therefore constitute direct financial execution authority.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). The prompt instructs deploying code into /opt (a system directory) and running a persistent sniper process there and also directs storing a private key in a .env — actions that require or encourage modifying system-level files/locations (likely needing sudo) and persistently changing machine state.

MEDIUM W021: Hidden or invisible Unicode characters detected (potential obfuscation or prompt injection).

• Hidden Unicode characters detected (1 type(s) found)