Pumpfun Agent Integration

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:28 AM UTC
• Version: 1.0.1

Overview

The skill is a payment bot scaffold, but its template contradicts its own safety rules by storing wallet private keys locally and signing blockchain transactions from the server.

Treat this as Review before installation. Do not use it with real funds or production Telegram users unless it is redesigned to avoid server-side private key custody and server-side signing, removes the unused treasury private key, enforces secure service-to-service transport, fixes vulnerable dependencies, and clearly documents the payment trust model.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/template/src/server.cjs:42

Finding

Customer Wallet Private Keys Stored in Plaintext

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: assets/template/src/server.cjs:129

Finding

Server Signs Transactions on Behalf of Users Contrary to Declared Safety Rules

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: assets/template/src/server.cjs:20

Finding

Unused Treasury Private Key Is Required and Loaded into the Web Process

Content

View full analysis

{ const secret = bs58.decode(env.TREASURY_SECRET_KEY_BASE58); return Keypair.fromSecretKey(secret); })(); ``` The setup guide instructs operators to provide the unnecessary secret: ```md cp .env.example .env # edit .env and set: # - TREASURY_SECRET_KEY_BASE58 # - API_TOKEN npm start ``` ### Technical Analysis The server requires a treasury secret key at startup, decodes it, and constructs a live `Keypair`. The resulting `treasury` object is not used by the payment, verification, balance, or credit workflows shown in either server implementation. Requiring an unused treasury key violates least privilege. It exposes high-value secret material to the environment and memory of an Internet-adjacent application process without providing any functional benefit. Even if the application does not deliberately transmit or log the key, process compromise, environment inspection, crash diagnostics, debugging tools, or future code changes can expose it. ### Attack Path 1. An operator follows the README and places a treasury private key in the application's environment. 2. The web process parses and decodes the secret at startup. 3. An attacker compromises the process, obtains environment-reading access, or ...[truncated 500 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: assets/template/src/telegram-bot.cjs:5

Finding

Billing Bearer Credential Can Be Sent to an Arbitrary Plaintext HTTP Endpoint

Content

View full analysis

''); throw new Error(`billing ${path} failed: ${res.status} ${text}`); } return res.json(); } ``` The same request construction is present in both Telegram implementations. ### Technical Analysis `z.string().url()` validates URL syntax but permits both HTTP and HTTPS and imposes no destination restrictions. Every billing request sends a reusable bearer credential in the `x-api-token` header. The default loopback URL is acceptable for a strictly local deployment. However, operators can configure a remote `http://` endpoint, causing the shared token and associated Telegram user identifiers to cross the network without TLS. A malicious or incorrectly configured endpoint can also directly capture the credential. The network transmission is necessary for the Telegram bot to authenticate to a separate billing service, but unrestricted plaintext transport exceeds the minimum secure privilege and confidentiality requirements. ### Attack Path 1. The bot is configured with a remote `http://` value in `BILLING_URL`. 2. The bot sends `BILLING_TOKEN` in the `x-api-token` header with each request. 3. A networ ...[truncated 643 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/PUMP_TOKENIZED_AGENTS.md:11

Finding

Mutable External Skill Reference Introduces Instruction Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch shows the skill claims to implement payment and Telegram/server integration logic, but may actually only perform template stamping without the promised verification and payment functionality. In a payments context, that can lead downstream users to deploy incomplete or insecure systems under the false assumption that invoice/payment validation is present, causing broken payment controls or unsafe custom additions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch shows the skill claims to implement payment and Telegram/server integration logic, but may actually only perform template stamping without the promised verification and payment functionality. In a payments context, that can lead downstream users to deploy incomplete or insecure systems under the false assumption that invoice/payment validation is present, causing broken payment controls or unsafe custom additions.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/template/README.md (reported line 9)May include surrounding context.

bash

cd demo-billing
cp .env.example .env
# edit .env and set:
# - TREASURY_SECRET_KEY_BASE58
# - API_TOKEN

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/template/README.md (reported line 10)May include surrounding context.

bash

cd demo-billing
cp .env.example .env
# edit .env and set:
# - TREASURY_SECRET_KEY_BASE58
# - API_TOKEN
npm start

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/stamp_template.sh (reported line 38)May include surrounding context.

sh

```bash
cd demo-billing
cp .env.example .env
# edit .env and set:
# - TREASURY_SECRET_KEY_BASE58
# - API_TOKEN
npm start

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins bigint-buffer 1.1.5, which is reported vulnerable to a buffer overflow in toBigIntLE(). Even though this package is transitive, shipping a known vulnerable native/binary-adjacent parsing dependency in a payment-oriented Solana stack creates real memory-safety risk if attacker-controlled data can reach the affected code path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

fast-uri 3.1.0 is a known vulnerable dependency and is used by Fastify's schema/URL handling stack. The cited host confusion and SSRF-class issues are especially relevant in a web server template, because malformed URLs, IDNs, or authority parsing discrepancies can undermine origin validation, allow outbound request abuse, or bypass security checks that rely on canonical host parsing.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fastify==5.8.2 — 3 advisory(ies): CVE-2025-32442 (Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He); CVE-2026-3635 (fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host ); CVE-2026-18504 (fastify vulnerable to schema validation bypass via root primitive coercion misma)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

fastify 5.8.2 is directly included by the template and the advisories affect core request parsing, schema validation, and forwarded host/protocol handling. In a Telegram+web payment bot scaffold, validation bypasses or spoofed host/protocol values can lead to authentication mistakes, webhook trust errors, poisoned callback URLs, or acceptance of malformed payment-related requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: find-my-way==9.5.0 — 1 advisory(ies): CVE-2026-47219 (find-my-way: DDoS with HTTP2)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

find-my-way 9.5.0 is Fastify's router and is reported vulnerable to HTTP/2-triggered DoS. Because this skill generates an internet-facing web server, an attacker could exploit expensive routing behavior to degrade availability, which is meaningful for payment verification and bot endpoints even if it is not a direct compromise of confidentiality or integrity.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

ws 8.19.0 is reported vulnerable to memory disclosure and memory exhaustion DoS. In a stack that includes Solana RPC/websocket functionality, a vulnerable websocket client/server library can expose sensitive process memory or allow remote resource exhaustion if attacker-controlled websocket traffic is accepted or proxied.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: toml==3.0.0 — 2 advisory(ies): CVE-2026-77465 (toml-node: Uncontrolled Recursion); CVE-2026-63376 (toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__pro)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

toml 3.0.0 is flagged for uncontrolled recursion and prototype pollution. Although likely transitive via Anchor tooling, prototype pollution in Node.js dependency chains can become serious if untrusted TOML is ever parsed, and recursion flaws can enable denial of service; however in this runtime template the package is less obviously exposed than the web server components.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

ws 7.5.10 is vulnerable to memory exhaustion DoS from tiny fragments/data chunks. Because this older websocket version is also present in the dependency tree, the application may remain exposed even if newer branches are patched elsewhere, and availability attacks are particularly damaging for bot polling, RPC connectivity, and payment-verification services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fastify==5.8.2 — 3 advisory(ies): CVE-2025-32442 (Fastify has a Body Schema Validation Bypass via Leading Space in Content-Type He); CVE-2026-3635 (fastify: request.protocol and request.host Spoofable via X-Forwarded-Proto/Host ); CVE-2026-18504 (fastify vulnerable to schema validation bypass via root primitive coercion misma)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The manifest includes fastify 5.8.2, which is explicitly identified as affected by multiple advisories, including schema validation bypasses and spoofable request protocol/host handling. In this skill's context, that is more dangerous because it scaffolds an internet-facing Express-style/Fastify web server for payment and invoice verification flows, where request spoofing or validation bypass can undermine trust boundaries, routing, security checks, or payment-related business logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code explicitly stores generated deposit private keys in plaintext Base58 form inside SQLite. This creates a single highly sensitive theft target; any local file disclosure, backup leak, SQL access, or host compromise exposes private keys that allow immediate draining of user funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Persisting per-user private keys in a local SQLite database without any disclosure or protection details is a serious secret-management flaw. Anyone who gains filesystem, backup, log, or database access can recover those keys and drain user wallets, and users are not informed that the service is acting as a custodian. The skill context makes this more dangerous because it is presented as a ready-made scaffold likely to be copied into real services.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This function signs and broadcasts a Solana transaction using a server-controlled deposit wallet, which is an irreversible external operation. The code has only an internal implementation comment and lacks any user-facing warning, confirmation step, or documented disclosure that funds may be moved on-chain automatically.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/stamp_template.sh (reported line 38)May include surrounding context.

sh

( cd "$TEMPLATE_DIR" && tar -cf - . ) | ( cd "$OUT_DIR" && tar -xf - )

# Remove common local state if it slipped in
rm -f "$OUT_DIR"/*.log "$OUT_DIR"/*.pid "$OUT_DIR"/demo.db "$OUT_DIR"/.env "$OUT_DIR"/.env.local 2>/dev/null || true

echo "Stamped template to: $OUT_DIR"
echo "Next: cd '$OUT_DIR' && npm install"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/stamp_template.sh (reported line 38)May include surrounding context.

sh

( cd "$TEMPLATE_DIR" && tar -cf - . ) | ( cd "$OUT_DIR" && tar -xf - )

# Remove common local state if it slipped in
rm -f "$OUT_DIR"/*.log "$OUT_DIR"/*.pid "$OUT_DIR"/demo.db "$OUT_DIR"/.env "$OUT_DIR"/.env.local 2>/dev/null || true

echo "Stamped template to: $OUT_DIR"
echo "Next: cd '$OUT_DIR' && npm install"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs operators to place a treasury private key and API token into a local .env file without any warning about secret handling, storage hygiene, rotation, or preventing accidental disclosure. In a payment-handling Solana/Telegram service, this increases the chance that high-value credentials are mishandled, committed to source control, or exposed in logs or screenshots, leading to wallet compromise or unauthorized API use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code loads a treasury secret key from an environment variable and configures a database path, then later stores per-user deposit private keys in the database. There is no confirmation prompt, visible warning, or explanatory comment disclosing that sensitive credentials and user wallet secrets are being handled and persisted locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The server generates and persistently stores per-user Solana private keys in SQLite, making the application a custodial wallet system rather than a simple payment scaffold. If the database, backups, logs, or host are compromised, attackers can extract user wallet secrets and steal all funds from those deposit wallets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The deposit check accepts any existing wallet balance as satisfying a new funding request, without proving that a fresh deposit corresponding to the current request occurred. Because deposit wallets are reused per user, previously leftover funds can be counted again for later crediting flows, enabling replay-style over-crediting or mismatched accounting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

These lines serialize and broadcast a signed transaction, transmitting wallet activity to the Solana RPC endpoint. The code does not include a confirmation prompt, visible log/print, or explanatory warning near the operation, even though it initiates an external network action affecting funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This handler debits credits from a user's stored balance, which is a destructive state change. There is no visible confirmation, warning, or explanatory disclosure in the code around this irreversible operation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: assets/template/src/standalone-telegram.cjs:13

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: assets/template/src/telegram-bot.cjs:11