The Flip

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:29 PM UTC
• Version: 0.1.0

Overview

This devnet Solana game is mostly coherent, but it includes under-disclosed wallet-signing/admin actions and unsafe setup/dependency risks that users should review carefully before installing.

Install only in an isolated devnet environment with a disposable Solana keypair and no mainnet funds. Do not run the curl-piped installer without independently verifying it, review all wallet-signing transactions before approval, and avoid using this code for real-value gambling unless the randomness, jackpot accounting, dependency vulnerabilities, and admin-command separation are fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:106

Finding

Unverified Remote Installer Is Downloaded and Executed by a Shell

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: program/src/lib.rs:101

Finding

Gambling Results Are Derived from Predictable and Influenceable On-Chain Values

Content

View full analysis

> bit_idx) & 1; game.round_results[base_idx + i] = if bit == 0 { 1 } else { 2 }; } ``` ### Technical Analysis A cryptographic hash does not create entropy when all of its inputs are public, predictable, or subject to influence: - `game.current_round` is public state. - `game.key()` is a fixed public address. - `clock.slot` is observable and can be targeted through transaction timing. - `clock.unix_timestamp` has limited granularity and is associated with validator-controlled block production. The `flip` operation is permissionless, so any signer can choose when to submit a flip after the cooldown expires. A block producer has greater influence because it can control transaction inclusion and has protocol-bounded influence over the execution environment. Predictions are stored on-chain before the flip, allowing prospective results to be compared against known tickets. Hashing these values prevents direct inversion but does not prevent selection or grinding across candidate execution conditions. This construction is therefore unsuitable for a game in which randomness controls monetary payo ...[truncated 1451 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: program/src/lib.rs:133

Finding

Historical Winning Tickets Can Claim Jackpot Funds Deposited for Later Rounds

Content

View full analysis

ticket.round, FlipError::RoundNotFlipped ); // Must be within buffer window (last 32 rounds) require!( game.current_round - ticket.round <= ROUNDS_BUFFER as u32, FlipError::BufferExpired ); require!(!ticket.collected, FlipError::AlreadyCollected); // Verify first 14 predictions match round results let base_idx = (ticket.round as usize % ROUNDS_BUFFER) * PREDICTIONS_SIZE; for i in 0..SURVIVAL_FLIPS { require!( ticket.predictions[i] == game.round_results[base_idx + i], FlipError::NotAWinner ); } ticket.winner = true; ticket.collected = true; game.total_wins += 1; // Winner takes the entire jackpot let payout = game.jackpot_pool; // PDA signer seeds for vault let authority_key = game.authority; let seeds = &[ b"vault" as &[u8], authority_key.as_ref(), &[game.vault_bump], ]; let signer_seeds = &[&seeds[..]]; let cpi_ctx = CpiContext::new_with_signer( ctx.accounts.token_program.to_account_info(), Transfer { from: ctx.accounts.vault.to_account_info(), to: ctx.accounts.player_token_account.to_account_info(), authority: ctx.accounts.vault.to_account_info(), }, signer_seeds, ); token::transfer(cpi_ctx, payout)?; game.jackpot_pool = 0; ``` ### Technical Analysis Ticket eligibility is tied to a historical `ticket.round`, but the payout is taken from the current global `game.jackpot_pool`. The program does not snapshot or allocate a jackpot amount to an individual round when that round is flipped. A winning ticket remains claimable while its result remains in the 32-round circular buffer. During that period, new players can continue entering subsequent rounds, and 99% of every new entry is added to the same global ja ...[truncated 1667 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (81)

Known Vulnerable Dependency: next==16.0.10 — 16 advisory(ies): CVE-2026-44575 (Next.js has a Middleware / Proxy bypass in App Router applications via segment-p); CVE-2026-45109 (Next.js has a Middleware / Proxy bypass in App Router applications via segment-p); GHSA-2xp9-vwfh-vxw4 (Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AV) +13 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence

Finding

next==16.0.10 is explicitly identified as having multiple advisories, including critical issues such as unauthenticated RCE in the Image Optimization API and middleware/proxy bypasses. In a wallet-connected gaming application, compromise of the frontend server could enable phishing flows, transaction manipulation, session abuse, or user data exposure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a simple devnet jackpot game, while the static findings indicate hidden or inconsistent behavior such as admin withdrawal capability, operator fees, or a different execution environment. Mismatches between stated behavior and actual behavior are dangerous because users may approve actions involving funds or trust assumptions they would reject if accurately disclosed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The withdraw-fees command can transfer operator funds from the game vault using the local authority wallet, but this administrative capability is not justified by the end-user gameplay description. If bundled into a user-consumable skill, it creates a high-risk path for unauthorized or accidental fund movement when an operator wallet is available on the machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The close-game-v1 command performs a destructive lifecycle action that can close a game PDA for migration, yet it is exposed in the same script as routine gameplay commands. This is dangerous because a user or automation invoking the script may trigger irreversible administrative state changes under the authority wallet without appreciating the impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The destructive close-game-v1 operation lacks an explicit confirmation prompt or safety interlock before submitting the transaction. Because it is adjacent to normal commands in a game demo script, the absence of a confirmation step materially raises the risk of accidental irreversible administrative actions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

bigint-buffer 1.1.5 is flagged for a buffer overflow in toBigIntLE(), and it is present as a production transitive dependency via Solana token tooling. Even though this lockfile alone does not prove a reachable exploit path, memory-corruption issues in parsing/serialization libraries are generally high risk because malformed input can trigger crashes or undefined behavior in client processes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

brace-expansion 2.0.2 has multiple DoS issues involving pathological pattern expansion. In this lockfile it appears as a dev/test dependency path, so it is less likely to affect production runtime, but it remains a real vulnerability if CI, local tooling, or any service-side developer utility processes untrusted glob-like patterns.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

js-yaml 4.1.1 has several CPU exhaustion issues on crafted YAML input. In this project it is present through dev tooling, which reduces direct user-facing risk, but YAML parsers are commonly exposed in CI/config workflows and can still be abused for denial of service if untrusted files are processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

minimatch 9.0.5 is affected by ReDoS conditions from crafted glob patterns. Since it is a dev dependency in this tree, production exploitability is reduced, but any automation or service that accepts attacker-controlled patterns could suffer CPU exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

ws 8.19.0 is flagged for memory disclosure and memory exhaustion issues, and it is included in the runtime path via rpc-websockets used by Solana web3 connectivity. Because this skill interacts with live blockchain infrastructure over WebSockets, a vulnerable WS client/server library is more relevant than usual and could enable denial of service or leakage during hostile network interactions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: serialize-javascript==6.0.2 — 2 advisory(ies): GHSA-5c6j-r48x-rmvq (Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to); CVE-2026-34043 (Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

serialize-javascript 6.0.2 has an RCE-related advisory and a CPU exhaustion issue, but in this lockfile it is only present through mocha as a dev dependency. That makes the risk much lower for the deployed skill, though it is still a real issue in developer or CI environments that serialize attacker-influenced objects.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: toml==3.0.0 — 2 advisory(ies): CVE-2026-77465 (toml-node: Uncontrolled Recursion); CVE-2026-63376 (toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__pro)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

toml 3.0.0 is affected by uncontrolled recursion and prototype pollution. Anchor depends on toml at runtime for configuration parsing, so if this skill or adjacent tooling ingests attacker-controlled TOML, it could trigger crashes or object prototype corruption with broader application consequences.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

ws 7.5.10 is vulnerable to memory exhaustion from fragmented frames, but this instance is under jayson and appears in a secondary dependency path. It is still a genuine DoS risk if hostile WebSocket traffic reaches that stack, though likely less central than the ws 8.x instance used by rpc-websockets.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 90% confidence

Finding

This component builds a block with dangerouslySetInnerHTML from dynamic values in config, including chart keys and color/theme strings, without escaping or constraining them. If any part of config can be influenced by untrusted input, an attacker can break out of the CSS context and inject arbitrary style content and potentially script-adjacent payloads, resulting in DOM-based injection/XSS risk.

Content

Scanner excerpt · web/components/ui/chart.tsx (reported line 83)May include surrounding context.

tsx

return (
    <style
      dangerouslySetInnerHTML={{
        __html: Object.entries(THEMES)
          .map(
            ([theme, prefix]) => `

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The test script invokes ts-mocha through npx without pinning an exact version, which can cause execution of whatever version is resolved at runtime from the local environment or registry. In a development workflow, this introduces supply-chain risk: a compromised, typosquatted, or unexpectedly updated package could execute arbitrary code during test runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example command uses a local keypair path without clearly stating that only a disposable devnet/test wallet should be used. Users may accidentally run the command with a real wallet file, increasing risk of operational mistakes, privacy loss, or signing unintended transactions in a blockchain context.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 290)May include surrounding context.

bash

# Game state (base64 -> decode with IDL layout)
curl -s https://api.devnet.solana.com -X POST -H "Content-Type: application/json" -d '{
  "jsonrpc": "2.0", "id": 1,
  "method": "getAccountInfo",
  "params": ["AAEwxhqM1EGjTbCyPqSCX7YpyuRqzBBfyf2kJG1nsGqd", {"encoding": "base64"}]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill invokes Node-based commands, references external APIs, and instructs users to interact with wallets and network resources, but it declares no explicit tool scope or permissions. That weakens least-privilege controls and makes it harder for agents or users to understand that network and environment access are required before running the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The enter command causes a wallet-funded USDC transaction, but the skill does not present a prominent warning at the point of use that real wallet funds will be spent. In an agent context, insufficient spend disclosure can trick or rush users into authorizing transfers they do not fully understand, especially when a wallet path is accepted as an argument.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: app/demo.mjs:44

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: app/demo.mjs:44