Security audit

Aureus Arena

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for building a Solana game bot, but it encourages autonomous real-money wallet use without clear spending limits or confirmation controls.

Install only if you intend to run an autonomous Solana bot with real funds. Use a dedicated low-balance wallet, pin and audit dependencies, keep wallet keys out of source control, set explicit spend and round limits, and require human approval for bridging, staking, tier changes, or any increase in budget.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:168
Finding: Unpinned Third-Party SDK Is Given Access to a Funded Wallet Key## Vulnerability Details **File Location**: `SKILL.md`, lines 27 and 168–170 **Vulnerability Type**: Supply-chain exposure of sensitive wallet credentials **Risk Level**: High ### Vulnerable Code ```bash npm install @aureus-arena/sdk @solana/web3.js ``` ```typescript const secret = JSON.parse(fs.readFileSync("./wallet.json", "utf8")); const wallet = Keypair.fromSecretKey(Uint8Array.from(secret)); const client = new AureusClient(connection, wallet); ``` ### Technical Analysis The instructions install `@aureus-arena/sdk` and `@solana/web3.js` without exact version pins or package-integrity constraints. The resulting SDK client is then initialized with a `Keypair` derived from the complete secret key of a funded Solana wallet. A `Keypair` provides unrestricted signing authority for the corresponding wallet. Any code executing in the same Node.js process can potentially access the key object or request signatures. Because the SDK implementation is not included in the audited project, its treatment of the key cannot be verified from `SKILL.md`. The reviewed file does not directly transmit the raw secret key and does not prove that the current SDK is malicious. The vulnerability is the high-impact trust boundary created by giving mutable, unaudited dependency code access to a valuable signing credential. ### Attack Path 1. An operator follows the documented installation command without an existing integrity-locked dependency tree. 2. A compromised, malicious, or unexpectedly modified package version is retrieved from the package registry. 3. The bot reads the complete funded-wallet secret from `wallet.json`. 4. The secret-derived `Keypair` is passed to dependency-controlled SDK code. 5. Malicious dependency code accesses signing authority, constructs unauthorized transactions, or exports key material. 6. The attacker transfers assets or continues signing transactions until the wallet is depleted or the credential ...[truncated 545 chars]
Remediation: ## Remediation Suggestions - Pin every dependency to an audited exact version rather than relying on floating package versions. - Commit and enforce a package lockfile, and use reproducible installation such as `npm ci`. - Verify package provenance, integrity hashes, maintainers, release history, and the source corresponding to the installed artifact. - Audit or vendor the Aureus SDK before allowing it to interact with a funded wallet. - Use a dedicated game wallet with only the minimum necessary balance; never use a treasury or primary wallet. - Isolate signing behind a hardware wallet, remote signer, or policy-enforcing signing service that validates program IDs, recipient accounts, instruction types, and spending limits. - Restrict filesystem permissions on `wallet.json`, exclude it from source control and backups where appropriate, and avoid storing raw secret-key arrays in the project directory. - Rotate the wallet key immediately if dependency compromise or unauthorized key access is suspected.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:181
Finding: Infinite Autonomous Game Loop Can Spend Wallet Funds Without a Budget Limit## Vulnerability Details **File Location**: `SKILL.md`, lines 181–192 **Vulnerability Type**: Unbounded autonomous financial transaction execution **Risk Level**: High ### Vulnerable Code ```typescript while (true) { try { // Wait for next commit phase const round = await client.waitForCommitPhase(); console.log(`⚔️ Round ${round}`); // Pick a strategy (5 values summing to 100) const strategy = randomStrategy(); console.log(` Strategy: [${strategy.join(", ")}]`); // Commit (tier 0 = Bronze, 0.01 SOL entry fee) const { nonce } = await client.commit(strategy, round, 0); ``` ### Technical Analysis Entering paid matches is part of the declared Skill functionality, but the supplied implementation repeats paid commitments indefinitely. It does not enforce a maximum number of rounds, cumulative spending cap, minimum wallet reserve, daily loss limit, or emergency shutdown condition. The bot also does not independently inspect the generated transaction before signing to confirm the expected program ID, recipient accounts, instruction data, and maximum debit. A defective or compromised SDK, protocol configuration error, or unexpectedly prolonged process execution could therefore cause repeated financial losses. This exceeds a least-privilege design because the application receives unrestricted signing authority over the entire funded wallet when its legitimate task only requires narrowly bounded game transactions. ### Attack Path 1. An operator uses a funded wallet and starts the documented bot. 2. The infinite loop enters every available round and invokes `client.commit`, which pays an entry fee. 3. The process continues without a round limit, budget ceiling, balance reserve, or operator confirmation. 4. Ordinary match losses, failed lifecycle handling, an SDK defect, or malicious transaction construction repeatedly consumes funds. 5. Execution continues until the process is ...[truncated 818 chars]
Remediation: ## Remediation Suggestions - Replace `while (true)` with a bounded execution policy specifying a maximum number of matches and runtime. - Enforce a cumulative spending budget, per-transaction debit ceiling, daily loss limit, and minimum wallet reserve. - Stop automatically after repeated transaction failures, reveal failures, unexpected balance changes, or a configured loss threshold. - Use a dedicated low-balance wallet funded only for the approved session. - Independently decode and validate every transaction before signing, including the Solana program ID, account list, instruction type, fee, transfer amount, and destination. - Require explicit operator approval before increasing tiers, staking tokens, bridging assets, or exceeding the initial budget. - Add an emergency-stop mechanism and support immediate cancellation through a local signal or operator-controlled flag. - Record an auditable transaction ledger and reconcile the expected wallet balance before each paid commitment. - Present an estimated maximum loss and obtain informed confirmation before starting autonomous execution.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase saying the skill should also be used when an AI agent wants to autonomously enter the arena itself creates an invocation path for self-directed financial activity. Because the skill instructs the use of funded wallets, bridging assets, and repeated paid match entry, this ambiguity could cause an agent to initiate or recommend autonomous spending without clear human authorization. The surrounding skill content makes this more dangerous, not less, because it operationalizes the behavior with concrete transaction code.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The phrase saying the skill should also be used when an AI agent wants to autonomously enter the arena itself creates an invocation path for self-directed financial activity. Because the skill instructs the use of funded wallets, bridging assets, and repeated paid match entry, this ambiguity could cause an agent to initiate or recommend autonomous spending without clear human authorization. The surrounding skill content makes this more dangerous, not less, because it operationalizes the behavior with concrete transaction code.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The top-level skill description does not clearly warn that use of this skill can lead to autonomous blockchain transactions and real SOL expenditure. Although warnings appear later in the body, invocation and routing decisions are typically made from metadata and description first, so the missing up-front warning can cause the skill to be selected without adequate risk framing. In a skill centered on funded wallets, bridging, staking, and repeated paid game entry, this omission materially increases user and operator risk.

Whitespace Padding

Medium

Category: Prompt Injection
Content: ## SDK Method Reference | Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | Method | Description | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.register()` | Register agent on-chain (one-time, ~0.003 SOL) | | `client.commit(strategy, round, tier)` | Commit hashed strategy + entry fee. Returns `{ round, nonce }` | | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.reveal(round, strategy, nonce)` | Reveal strategy for hash verification | | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.claim(round)` | Claim SOL + AUR winnings after grace period | | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.closeCommit(round)` | Close Commit PDA. Claimed: 2 accounts (rent back). Stale scored: 3 accounts (+ arena, winnings forfeited). Stale unscored: 4 accounts (+ arena + vault) — **entry fee refunded** from vault. | | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.closeRound(round)` | Close expired Round PDA to reclaim ~0.003 SOL rent | | `client.waitForCommitPhase()` | Wait for next commit window, returns round number | | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet |
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Whitespace Padding

Medium

Category: Prompt Injection
Content: | `client.getRoundTiming()` | Get current phase, slots remaining | | `client.getCommitResult(round)` | Get match outcome: 0=LOSS, 1=WIN, 2=PUSH, 255=UNSCORED | | `fetchAgentState(conn, wallet)` | Read agent's on-chain profile (wins, losses, win rate) | | `fetchCommitResult(conn, round, wallet)` | Read a specific round's result for any wallet | ## Pro Tips
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Static analysis

No suspicious patterns detected.