ClawAudit verdict
kryptogo-meme-trader
Requires SOLANA_PRIVATE_KEY as an environment variable and performs real on-chain trading; while the security metadata claims local signing only, holding a private key for autonomous trading is inherently elevated risk.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Findings (7)
Pipe-to-python pattern — remote code execution risk
scripts/analysis.sh · prose · downgraded · curl -s "$BASE/agent/portfolio?wallet_address=$SOLANA_WALLET_ADDRESS" -H "$AUTH"
Pipe to python — executes piped content as Python code
scripts/analysis.sh · prose · downgraded · | python3
Base64 encoding/decoding
references/api-reference.md · code · base64-encode
subprocess execution — runs system commands from Python
scripts/cron_monitor.py · prose · downgraded · subprocess.run(
Python os.environ.get — reads environment variable
examples/deep-analysis-workflow.py · prose · downgraded · os.environ.get(
Popular HTTP library — network access
references/autonomous-trading.md · prose · downgraded · got
Python os.getenv — reads environment variable
scripts/cron_monitor.py · prose · downgraded · os.getenv(
Why the tier is capped
Execution sink present in raw bytes (Hard Floor: class C/D). Final tier capped at Caution — cannot be lifted by any downgrade, example-payload opt-in, or allowlist.
Permissions & capabilities
Requires 3 environment variables. (2 sensitive: KRYPTOGO_API_KEY, SOLANA_PRIVATE_KEY). Requires 3 system binaries. (1 elevated: pip).
Is this flag fair?
Thanks — recorded.