test

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:21 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent Solana NFT mint guide, but it asks users to sign an opaque backend-generated transaction with a funded wallet without requiring transaction inspection first.

Review before installing or using. Use only a dedicated Solana wallet with minimal funds, and do not sign the returned transaction unless you can independently decode and verify its exact effects, including fees, transfers, programs, signer and writable accounts, mint and collection addresses, and any authority changes.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:72

Finding

Blind Signing of an Unverified Server-Generated Solana Transaction

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 72-110
Vulnerability Type: Blind signing of an untrusted blockchain transaction
Risk Level: High

Vulnerable Code

json

{
  "transaction": "<base64_encoded_transaction>",
  "nftMint": "<public_key_of_new_nft>",
  "villainId": 42,
  "imageUrl": "https://...",
  "traits": {"body_color": "green", "hat": "top_hat", ...},
  "rarityScore": 73
}

markdown

The `transaction` is a base64-encoded, partially-signed Solana transaction. The backend has co-signed it as collection authority.

javascript

import { VersionedTransaction } from "@solana/web3.js";

const tx = VersionedTransaction.deserialize(
  Buffer.from(transaction, "base64")
);
tx.sign([yourKeypair]);

javascript

const signedTxBase64 = Buffer.from(tx.serialize()).toString("base64");

bash

curl -X POST https://chum-production.up.railway.app/api/villain/execute \
  -H "Content-Type: application/json" \
  -d '{
    "transaction": "<base64_encoded_signed_transaction>"
  }'

Technical Analysis

The skill directs the user to retrieve an opaque, partially signed transaction from a remote backend, deserialize it, and sign it with a funded Solana wallet. It does not require validation of the transaction message before signing.

Local signing protects the private key from direct disclosure, but it does not protect the assets controlled by that key. A valid signature authorizes the instructions encoded in the transaction. The documented flow does not verify:

• The invoked Solana program IDs.
• The transaction fee payer.
• Writable and signer accounts.
• SOL transfer recipients and amounts.
• Token or NFT transfers.
• Authority changes, approvals, or delegations.
• The expected mint and collection addresses.
• The claimed 0.001 SOL mint price or a maximum total debit.
• Address lookup tables used by a v ...[truncated 1735 chars]

Remediation

View remediation

Remediation Suggestions

1. Decode and validate the complete transaction message before requesting a signature.
2. Allow only explicitly expected program IDs, including the precise Metaplex and System Program operations required for minting.
3. Verify every account referenced by every instruction, including signer and writable flags.
4. Confirm the fee payer, expected NFT mint, collection address, destination wallet, and collection authority against trusted local configuration rather than backend response fields.
5. Calculate all SOL and token balance changes and reject transactions exceeding the advertised mint price and a conservative maximum network-fee threshold.
6. Reject token transfers, NFT transfers, delegate approvals, authority changes, durable nonces, unexpected compute-budget settings, and unknown instructions unless they are explicitly required and documented.
7. For versioned transactions, resolve and validate all address lookup tables before signing; reject unknown or mutable lookup-table dependencies.
8. Present a human-readable transaction summary—including recipients, amounts, programs, assets, and authority changes—and require explicit confirmation.
9. Compare nftMint and the collection address with the addresses encoded in the actual transaction rather than trusting separate JSON metadata.
10. Submit the validated signed transaction directly to a trusted Solana RPC endpoint where practical, reducing reliance on the transaction-producing backend.
11. Use a dedicated wallet containing only the minimum funds necessary for the mint to limit loss if validation fails.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 39)May include surrounding context.

Step 1: Request a challenge

bash

curl -X POST https://chum-production.up.railway.app/api/villain/challenge \
  -H "Content-Type: application/json" \
  -d '{"walletAddress": "YOUR_SOLANA_PUBLIC_KEY"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the user to deserialize, sign, and submit a backend-provided partially signed Solana transaction without any guidance to inspect its instructions, signers, fee payer, transfer amounts, or destination accounts first. In a wallet-signing context, this is dangerous because a malicious or compromised backend could return a transaction that transfers SOL/tokens, delegates authorities, or performs other unintended state changes while the user blindly countersigns it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.