SNAP Private Payments

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 0.1.1

Overview

This Solana privacy-payment skill is coherent, but it needs Review because it can move funds and use shielded-fund secrets without clear safeguards or fully reviewable helper code.

Install only if you are comfortable letting an agent operate a real Solana payment workflow. Use small test amounts and a limited wallet first, review the full SNAP SDK and missing shared helper code, use trusted RPC and relayer endpoints, and require explicit approval before every deposit, withdrawal, balance lookup, or use of a note or viewing key.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill metadata and description enumerate deposit, withdraw, pool listing, and fee estimation, but the command list also exposes shielded balance checking. This mismatch can bypass user expectations and policy review, especially because balance checks in privacy systems often require sensitive viewing keys or reveal metadata the user may not expect to share.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill exposes a balance-check capability that consumes a sensitive viewing key even though that capability is not described in the declared skill surface. Hidden or undocumented capabilities are dangerous because an agent or integrator may invoke them without understanding that private financial metadata can be accessed, creating confidentiality and consent issues. In a privacy-preserving payments skill, undisclosed balance inspection is especially sensitive because it undermines user expectations around shielded funds.

Intent-Code Divergence

Low

• Confidence: 85% confidence
• Finding: The file-level documentation states that the wrapper exposes a balance check, while the manifest reportedly omits that capability. This mismatch is a security-relevant documentation defect because operators may rely on the manifest for allowed behaviors while the code and comments encourage broader use, increasing the chance of unintended exposure of private account information. The issue is lower impact than direct code execution flaws but still contributes to unsafe deployment and consent bypass.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill strongly emphasizes 'private payments' but does not disclose that RPC providers, relayers, and associated infrastructure may still observe metadata such as IP address, timing, account interactions, or withdrawal requests. This can cause users to overestimate anonymity and make riskier transfers based on incomplete privacy assumptions.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill strongly emphasizes 'private payments' but does not disclose that RPC providers, relayers, and associated infrastructure may still observe metadata such as IP address, timing, account interactions, or withdrawal requests. This can cause users to overestimate anonymity and make riskier transfers based on incomplete privacy assumptions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The balance-check path directly uses context.viewingKey to inspect shielded funds without any visible user-facing disclosure, confirmation, or local guardrail. Viewing keys are highly sensitive because they reveal private balance information; silently consuming them in an agent skill can leak financial metadata through unexpected invocation, logs, or downstream integrations. Given this is a private-payments skill, undisclosed viewing-key access is more dangerous because users specifically expect confidentiality.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.