T08 · Insecure Dependencies
Error
- Location
SKILL.md:33- Finding
Unpinned Third-Party MCP Package Is Granted Access to a Solana Keypair
- Content
View full analysis
- Remediation
View remediation
Security audit
Poke Perps
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its stated trading purpose, but its live-funds execution path is under-scoped and exposes a Solana keypair to an unpinned external MCP package.
Install only in read-only mode unless you are prepared for real Solana mainnet trades. For execution, use a dedicated low-balance wallet, pin and verify the MCP package version, review every transaction before signing, and do not let an agent autonomously deposit, withdraw, or open leveraged positions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/EXAMPLES.md:134- Finding
Trading Examples Sign Transactions Containing Unverified Backend-Supplied Accounts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [references/EXAMPLES.md](references/EXAMPLES.md) — Complete code examples (TypeScript, Python, cURL)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples implement real mainnet deposit, open-position, close-position, and withdraw flows against Solana mainnet and a production backend, but provide no warning that these actions move real funds and create irreversible on-chain transactions. In an agent skill context, examples are often reused verbatim; this materially increases the chance a user or downstream tool executes loss-inducing trades without informed consent or sufficient safeguards.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The invocation guidance says to use the skill when the user asks about Pokemon card trading, perpetual futures, or PokePerps, which is broad enough to trigger this execution-capable skill for general informational queries about Pokemon cards. Because the skill includes wallet-linked trading and fund-moving operations, overly broad activation increases the chance an agent routes benign research requests into a high-risk financial toolchain and takes inappropriate preparatory or transactional steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly supports leveraged perpetual futures trading, deposits, withdrawals, and position execution, but the top-level invocation guidance and capability description do not require an explicit risk warning, user consent checkpoint, or confirmation before executing financially consequential actions. In an agent setting, broad execution capabilities combined with missing confirmation controls can lead to accidental or unauthorized trades, fund movement, and substantial losses, especially given support for up to 50x leverage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file explicitly documents execution-capable tools such as open_position, close_position, deposit, and withdraw, including how to enable them with a local Solana keypair, but it does not include any clear warning about irreversible on-chain actions, leverage risk, or the need for explicit user confirmation before trading. In an AI-agent context, this increases the chance that an assistant could autonomously facilitate or trigger financially harmful actions, especially given the platform supports up to 50x leverage and blockchain transactions are difficult or impossible to reverse.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents endpoints that retrieve user account balances, deposits, withdrawals, positions, and portfolio data keyed by wallet address. While the file notes authentication requirements for read-only endpoints, it does not warn users that querying or subscribing to wallet-address-based endpoints can reveal sensitive financial activity and account information.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The transaction section documents endpoints that prepare actions with direct financial consequences, including deposits, withdrawals, opening leveraged positions, closing positions, and adding margin. Although it says the user must build, sign, and submit the transaction themselves, it does not explicitly warn about irreversible financial risk, leverage risk, or the need for user review before signing.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples send wallet addresses and account/trading metadata to a remote backend without any privacy notice or data-minimization guidance. While wallet addresses are public on-chain, correlating them with off-chain research, account existence, positions, and behavior through a centralized API can create avoidable privacy leakage and user profiling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Health check curl https://backend.pokeperps.fun/api/system/health # Get tradable products curl https://backend.pokeperps.fun/api/trading/tradable
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document provides step-by-step instructions for depositing funds, opening leveraged positions, closing positions, and withdrawing, but it does not include prominent warnings about liquidation risk, leverage amplification, oracle/pricing dependency, transaction finality, or the possibility of permanent financial loss. In a skill explicitly designed to facilitate perpetual futures trading, omission of these safety disclosures can materially increase the chance that users execute risky on-chain actions without informed consent.
- Content