Blowfish Launch

• Analyzed: May 12, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 745e4c30646a3331c005b01d6c00ea63c48413e72af6ef46c52a80f480697f8d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. Its purpose is to launch tokens on Solana via the Blowfish Agent API, which requires a Solana keypair. The `scripts/blowfish-launch.ts` script correctly reads the `WALLET_SECRET_KEY` environment variable, uses it to sign an authentication message, and then interacts with the `https://api-blowfish.neuko.ai` endpoint as described. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts in `SKILL.md` that would subvert the agent's intended behavior. All network calls are to the documented API, and the handling of the sensitive `WALLET_SECRET_KEY` is consistent with the skill's stated purpose.