Security audit

Fortuna Lottery

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about buying Solana lottery tickets, but it can move real funds from a private key with limited built-in safeguards.

Install or use this only if you intentionally want an agent workflow that can buy FORTUNA lottery tickets with real SOL. Do not provide a main wallet private key; use a dedicated low-balance wallet, review the treasury address and amount before every purchase, and prefer a wallet integration with explicit approval over the fallback private-key script.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:113
Finding: Unpinned Third-Party Dependencies Execute in a Private-Key-Holding Process
Content: View full analysis
Remediation: View remediation
--hash=sha256: solders== --hash=sha256: ``` 2. Install dependencies with integrity enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Commit the lock file to the skill package and document the supported Python version. 4. Regularly review pinned releases and update them through a controlled security-review process. 5. Run the fallback script in an isolated virtual environment under a dedicated, unprivileged account. 6. Continue recommending a dedicated wallet with limited funds, minimizing the consequences of any dependency compromise. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/send_sol.py:24
Finding: Irreversible Mainnet Transfer Lacks Explicit Confirmation and Maximum-Spend Controls
Content: View full analysis
") print() print("Examples:") print(" send_sol.py 0.1 # 1 ticket") print(" send_sol.py 0.5 # 5 tickets") print(" send_sol.py 1.0 # 10 tickets") sys.exit(1) try: amount_sol = float(sys.argv[1]) except ValueError: print(f"ERROR: Invalid amount: {sys.argv[1]}") sys.exit(1) if amount_sol < TICKET_PRICE_SOL: print(f"ERROR: Minimum amount is {TICKET_PRICE_SOL} SOL (1 ticket)") sys.exit(1) ``` From `scripts/send_sol.py:72-105`: ```python # Account for transaction fee (~0.000005 SOL) required_sol = amount_sol + 0.00001 if balance_sol < required_sol: print(f"ERROR: Insufficient balance") print(f" Balance: {balance_sol:.6f} SOL") print(f" Required: {required_sol:.6f} SOL") sys.exit(1) lamports = int(amount_sol * LAMPORTS_PER_SOL) tickets = int(amount_sol / TICKET_PRICE_SOL) print(f"Sending {amount_sol} SOL to FORTUNA treasury (~{tickets} tickets)...") # Build and send transaction try: ix = transfer(TransferParams( from_pubkey=sender.pubkey(), to_pubkey=Pubkey.from_string(TREASURY), lamports=lamports, )) txn = Transaction().add(ix) resp = client.send_transaction(txn, sender) sig = str(resp.value) print(f"Transaction sent: {sig}") print(f"Tickets: ~{tickets}") print(f"Amount: {amount_sol} SOL") print(f"Verify: https://solscan.io/tx/{sig}") except Exception as e: print(f"ERROR: Transaction failed: {e}") sys.exit(1) ``` ### Technical Analysis The script accepts any floating-point amount of at least `0.1` SOL and immediately signs and broadcasts a mainnet transfer to the hardcoded treasury. I ...[truncated 2287 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to help check jackpot and round status, but the content also instructs the agent to perform direct financial actions, including sending SOL and using a fallback script that depends on a private key. This mismatch is dangerous because reviewers or users may treat it as informational/read-only while it actually enables value transfer on mainnet, which can cause real financial loss if invoked automatically or without informed consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares capabilities that require network access and optional use of a private key from the environment, but it does not explicitly scope or declare those permissions. That creates a trust and review gap: an agent may invoke external API calls or sign blockchain transfers without clear operator approval, increasing the risk of unintended fund movement or secret exposure in a high-risk financial context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.