Security audit

Aureus Arena

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building a Solana game bot, but it encourages autonomous real-money wallet use without clear spending limits or confirmation controls.

Install only if you intend to run an autonomous Solana bot with real funds. Use a dedicated low-balance wallet, pin and audit dependencies, keep wallet keys out of source control, set explicit spend and round limits, and require human approval for bridging, staking, tier changes, or any increase in budget.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:168
Finding: Unpinned Third-Party SDK Is Given Access to a Funded Wallet Key
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 27 and 168–170
Vulnerability Type: Supply-chain exposure of sensitive wallet credentials
Risk Level: High

Vulnerable Code

bash
npm install @aureus-arena/sdk @solana/web3.js

typescript
const secret = JSON.parse(fs.readFileSync("./wallet.json", "utf8")); const wallet = Keypair.fromSecretKey(Uint8Array.from(secret)); const client = new AureusClient(connection, wallet);

Technical Analysis

The instructions install @aureus-arena/sdk and @solana/web3.js without exact version pins or package-integrity constraints. The resulting SDK client is then initialized with a Keypair derived from the complete secret key of a funded Solana wallet.

A Keypair provides unrestricted signing authority for the corresponding wallet. Any code executing in the same Node.js process can potentially access the key object or request signatures. Because the SDK implementation is not included in the audited project, its treatment of the key cannot be verified from SKILL.md.

The reviewed file does not directly transmit the raw secret key and does not prove that the current SDK is malicious. The vulnerability is the high-impact trust boundary created by giving mutable, unaudited dependency code access to a valuable signing credential.

Attack Path

An operator follows the documented installation command without an existing integrity-locked dependency tree.

A compromised, malicious, or unexpectedly modified package version is retrieved from the package registry.

The bot reads the complete funded-wallet secret from wallet.json.

The secret-derived Keypair is passed to dependency-controlled SDK code.

Malicious dependency code accesses signing authority, constructs unauthorized transactions, or exports key material.

The attacker transfers assets or continues signing transactions until the wallet is depleted or the credential ...[truncated 545 chars]
Remediation: View remediation
Remediation Suggestions

Pin every dependency to an audited exact version rather than relying on floating package versions.

Commit and enforce a package lockfile, and use reproducible installation such as npm ci.

Verify package provenance, integrity hashes, maintainers, release history, and the source corresponding to the installed artifact.

Audit or vendor the Aureus SDK before allowing it to interact with a funded wallet.

Use a dedicated game wallet with only the minimum necessary balance; never use a treasury or primary wallet.

Isolate signing behind a hardware wallet, remote signer, or policy-enforcing signing service that validates program IDs, recipient accounts, instruction types, and spending limits.

Restrict filesystem permissions on wallet.json, exclude it from source control and backups where appropriate, and avoid storing raw secret-key arrays in the project directory.

Rotate the wallet key immediately if dependency compromise or unauthorized key access is suspected.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:181
Finding: Infinite Autonomous Game Loop Can Spend Wallet Funds Without a Budget Limit
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 181–192
Vulnerability Type: Unbounded autonomous financial transaction execution
Risk Level: High

Vulnerable Code

typescript
while (true) { try { // Wait for next commit phase const round = await client.waitForCommitPhase(); console.log(`⚔️ Round ${round}`); // Pick a strategy (5 values summing to 100) const strategy = randomStrategy(); console.log(` Strategy: [${strategy.join(", ")}]`); // Commit (tier 0 = Bronze, 0.01 SOL entry fee) const { nonce } = await client.commit(strategy, round, 0);

Technical Analysis

Entering paid matches is part of the declared Skill functionality, but the supplied implementation repeats paid commitments indefinitely. It does not enforce a maximum number of rounds, cumulative spending cap, minimum wallet reserve, daily loss limit, or emergency shutdown condition.

The bot also does not independently inspect the generated transaction before signing to confirm the expected program ID, recipient accounts, instruction data, and maximum debit. A defective or compromised SDK, protocol configuration error, or unexpectedly prolonged process execution could therefore cause repeated financial losses.

This exceeds a least-privilege design because the application receives unrestricted signing authority over the entire funded wallet when its legitimate task only requires narrowly bounded game transactions.

Attack Path

An operator uses a funded wallet and starts the documented bot.

The infinite loop enters every available round and invokes client.commit, which pays an entry fee.

The process continues without a round limit, budget ceiling, balance reserve, or operator confirmation.

Ordinary match losses, failed lifecycle handling, an SDK defect, or malicious transaction construction repeatedly consumes funds.

Execution continues until the process is ...[truncated 818 chars]
Remediation: View remediation
Remediation Suggestions

Replace while (true) with a bounded execution policy specifying a maximum number of matches and runtime.

Enforce a cumulative spending budget, per-transaction debit ceiling, daily loss limit, and minimum wallet reserve.

Stop automatically after repeated transaction failures, reveal failures, unexpected balance changes, or a configured loss threshold.

Use a dedicated low-balance wallet funded only for the approved session.

Independently decode and validate every transaction before signing, including the Solana program ID, account list, instruction type, fee, transfer amount, and destination.

Require explicit operator approval before increasing tiers, staking tokens, bridging assets, or exceeding the initial budget.

Add an emergency-stop mechanism and support immediate cancellation through a local signal or operator-controlled flag.

Record an auditable transaction ledger and reconcile the expected wallet balance before each paid commitment.

Present an estimated maximum loss and obtain informed confirmation before starting autonomous execution.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase saying the skill should also be used when an AI agent wants to autonomously enter the arena itself creates an invocation path for self-directed financial activity. Because the skill instructs the use of funded wallets, bridging assets, and repeated paid match entry, this ambiguity could cause an agent to initiate or recommend autonomous spending without clear human authorization. The surrounding skill content makes this more dangerous, not less, because it operationalizes the behavior with concrete transaction code.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The phrase saying the skill should also be used when an AI agent wants to autonomously enter the arena itself creates an invocation path for self-directed financial activity. Because the skill instructs the use of funded wallets, bridging assets, and repeated paid match entry, this ambiguity could cause an agent to initiate or recommend autonomous spending without clear human authorization. The surrounding skill content makes this more dangerous, not less, because it operationalizes the behavior with concrete transaction code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level skill description does not clearly warn that use of this skill can lead to autonomous blockchain transactions and real SOL expenditure. Although warnings appear later in the body, invocation and routing decisions are typically made from metadata and description first, so the missing up-front warning can cause the skill to be selected without adequate risk framing. In a skill centered on funded wallets, bridging, staking, and repeated paid game entry, this omission materially increases user and operator risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 307)May include surrounding context.
md
## SDK Method Reference | Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 309)May include surrounding context.
md
| Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 310)May include surrounding context.
md
| Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.
md
| ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.
md
| `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 314)May include surrounding context.
md
| `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
| `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.
md
| `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 317)May include surrounding context.
md
| `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 318)May include surrounding context.
md
| `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.
md
| `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet | ## Pro Tips

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Vague Triggers

Vague Triggers

Missing User Warnings

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding