Security audit

Blowfish Launch

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it handles a Solana private key and can trigger real token launches or fee claims without strong confirmation or safety guidance.

Review this before installing or running. Use only a dedicated low-value wallet, avoid exposing WALLET_SECRET_KEY in shell history or logs, and require a manual confirmation step before any launch or fee claim. Treat launches and claims as real blockchain operations, not simulations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill documents capabilities that require access to environment variables and outbound network calls, but it does not declare any explicit tool scope or permission boundaries. This increases the chance an agent runtime grants broader access than intended, making secret exposure or unintended external requests harder to constrain and audit.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs users to place a Solana private key in the WALLET_SECRET_KEY environment variable without any visible guidance on secure handling, storage, or avoidance of logging. Because this key authorizes blockchain actions, exposure through shell history, process inspection, CI logs, or misconfigured runtimes can lead to wallet compromise and unauthorized transactions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow describes launching tokens and claiming fees on Solana without an explicit warning that these actions can create real on-chain effects, may incur costs, and may be irreversible. In an agent setting, missing transaction-risk disclosures can cause users to authorize impactful financial actions without informed consent.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The API reference documents a live token-launch action that creates an on-chain asset, but it provides no explicit warning that invoking this endpoint has irreversible real-world effects and may incur costs or create public assets. In an agent setting, this increases the risk that a user or upstream workflow triggers token creation without fully informed consent, especially because the skill is explicitly designed to act on launch/deploy requests.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The fee-claim endpoint moves value by claiming accumulated trading fees, but the documentation does not include a warning that this is a funds-affecting action. In an autonomous or semi-autonomous agent context, the lack of a clear warning and confirmation requirement can lead to unintended fund movements or user confusion about the financial consequences of the call.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This code performs a remote token launch by POSTing to an external API endpoint, which can create or initiate on-chain token deployment, yet there is no explicit warning, dry-run, or confirmation step before the action is triggered. In the context of a launch skill, this is particularly risky because a user may interpret the action as informational or preparatory, while it actually initiates an irreversible external deployment workflow tied to their authenticated wallet.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script directly reads the full Solana wallet secret from WALLET_SECRET_KEY and uses it to sign an authentication challenge for a third-party API, but it provides no explicit user disclosure, confirmation, or guardrails around that highly sensitive credential use. In an agent-skill context, this is dangerous because invoking the skill causes private key material to be consumed for a remote operation, increasing the risk of accidental credential exposure, misuse, or signing actions the user did not fully understand.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/blowfish-launch.ts:100