Solana Stablecoin Payments in Real-time

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:23 AM UTC
• Version: 1.0.1

Overview

This skill does what it says: it streams public Solana USDC/USDT transfer data through Bitquery using one disclosed API key, with no hidden persistence or unrelated local access found.

Install and run this in a virtual environment or container, provide only the BITQUERY_API_KEY needed for Bitquery, avoid logging the full WebSocket URL because it contains the token, and consider pinning/hash-locking the Python dependency before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1; related installation instructions at SKILL.md:54 and SKILL.md:78
Vulnerability Type: Unpinned and unhashed third-party dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text

gql[websockets]>=3.4.0

Related installation command in SKILL.md:78:

bash

pip install 'gql[websockets]'

Technical Analysis

The project permits any future version of gql at or above version 3.4.0 and does not constrain or verify its transitive WebSocket dependencies. No lock file or cryptographic package hashes are provided. The documented direct installation command is even less restrictive because it installs the latest version selected by the package index.

Consequently, the code reviewed during this audit may not be the dependency code installed later. A compromised upstream release, dependency-confusion condition, or malicious transitive dependency could introduce attacker-controlled code. Such code could run during package installation where supported or when the dependency is imported by scripts/stream_stablecoin_payments.py.

Attack Path

1. An attacker compromises a future release of gql or one of its transitive dependencies, or otherwise influences dependency resolution.
2. A user follows the documented installation command or installs from requirements.txt.
3. pip resolves and downloads the attacker-controlled package because no exact version or hash validation prevents it.
4. Malicious code executes during installation or when the streaming script imports the affected package.
5. The code runs with the privileges of the user executing pip or the streaming script and can access data available to that process, including BITQUERY_API_KEY.

Impact Assessment

Exploitation could result in arbitrary code execution under the installing or runtime user's account. The accessible scope may include e ...[truncated 336 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin gql and all transitive dependencies to versions that have been reviewed and tested.
2. Generate a reproducible lock file with a tool such as pip-compile.
3. Record SHA-256 hashes for every permitted distribution and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Replace the unconstrained command in SKILL.md with installation from the locked, hash-verified requirements file.
5. Use only trusted package indexes and explicitly configure the expected index URL in controlled environments.
6. Run dependency vulnerability and provenance checks in CI, and review dependency updates before regenerating the lock file.
7. Install and run the skill in an isolated virtual environment or container with only the minimum required environment variables and filesystem permissions.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs network access and reads a sensitive environment variable (BITQUERY_API_KEY) but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens install-time transparency and policy enforcement, making it easier for a host agent or user to run code with broader capabilities than expected, including external data exfiltration if the skill is modified or misused.

Content

No source excerpt is available for this finding.