Reliable Pumpfun Price Feed

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:00 PM UTC
• Version: 1.0.4

Overview

This skill is a disclosed Bitquery WebSocket token feed with credential and dependency risks that are mostly explained and proportionate to its purpose.

Install this only in an isolated environment, keep BITQUERY_API_KEY out of logs and shell history, and consider pinning or reviewing dependencies before use. Treat the displayed trading signals as informational heuristics, not instructions to buy or sell.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Permits Unreviewed Future Releases

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; related installation instructions at SKILL.md:64 and SKILL.md:132
Vulnerability Type: Unpinned and unhashed third-party dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

gql[websockets]>=3.4.0

Related installation instruction in SKILL.md:64 and SKILL.md:132:

bash

pip install 'gql[websockets]'

Technical Analysis

The requirement specifies only a minimum version and has no upper bound, lockfile, or cryptographic hashes. Consequently, package installation may retrieve any future release of gql and the dependencies selected for its websockets extra from the configured Python package index.

The documented direct pip install command is even less restrictive because it does not specify any version. Python package installation can execute package build or installation logic, while imported dependency code executes at application runtime. The project therefore relies on code that may differ from the version originally reviewed.

This does not establish that the current gql package is malicious. The security issue is that a compromised or malicious future release, compromised transitive dependency, or unsafe package-index configuration could introduce unreviewed executable code.

Attack Path

1. An attacker compromises the publishing account, distribution process, or package-index entry for a permitted dependency or one of its transitive dependencies.
2. The attacker publishes a malicious release with a version satisfying gql[websockets]>=3.4.0.
3. A user installs the project requirements or follows the unversioned installation command in SKILL.md.
4. pip resolves and downloads the attacker-controlled release because no lockfile, upper boundary, or trusted hashes restrict the artifact.
5. Malicious code executes during package installation, package import, WebSocket setup, or str ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin gql to a specifically reviewed version instead of accepting every future release:

   text

   gql[websockets]==<reviewed-version>
   

2. Generate and commit a lockfile containing exact versions for all transitive dependencies.
3. Record cryptographic hashes for every approved distribution and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Replace the unversioned installation commands in SKILL.md with installation from the reviewed, hash-locked requirements file:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

5. Use an isolated virtual environment or container and never install the dependencies with administrator or root privileges.
6. Configure pip to use a trusted package index and disable unintended supplemental indexes to reduce dependency-confusion exposure.
7. Review dependency updates explicitly and regenerate pins and hashes only after testing and security review.
8. Add automated dependency and vulnerability scanning to the release process while retaining manual review for package ownership or provenance changes.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill performs network access and reads a sensitive environment variable (BITQUERY_API_KEY) but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and transparency gap: installers or runtimes may not clearly surface that the skill needs secret access and outbound connectivity, increasing the risk of unintended execution with broader privileges than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code generates and labels derived outputs as 'Trader Signals', including bullish/bearish momentum, mean-reversion suggestions, and pump/dump detection. The file contains no user-facing warning that these are heuristic indicators for volatile tokens and may influence trading decisions, which is a safety-relevant disclosure omission for code that presents actionable financial cues.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.