Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned for Solana on-chain storage, but it under-warns users around permanent public data, wallet-backed payments, and unsafe setup commands.
Review this skill carefully before installing or following it. Do not put secrets, keys, credentials, PII, regulated records, or private documents into IQDB, hanLock output, or x402 inscriptions unless you have applied strong client-side encryption and accepted the permanence risk. Verify any Solana installer before running it, pin dependency versions, and require explicit user review of payment recipient, amount, network, and file metadata before signing transactions.
references/setup.md:11Unverified Remote Installer Is Downloaded and Executed
skill.md:35Third-Party Packages Are Installed Without Version or Integrity Pinning
skill.md:134Weak Obfuscation Is Presented for Data Permanently Published On-Chain
references/x402-payments.md:39Payment Transaction Trusts an Unverified Quote Recipient and Amount
The example explicitly encourages storing password-obfuscated data on-chain via IQDB, while the document only elsewhere notes that hanLock is not real encryption. In the context of immutable public blockchain storage, users may wrongly infer that encoded data is private, leading to permanent exposure of secrets or sensitive records that can later be recovered or brute-forced.
This markdown file describes pushInstruction being used to delete an existing row by passing an empty string, but it does not warn users about the consequences of deletion-like operations on stored data. Under the markdown-file criteria for missing user warnings, behaviors that affect user data should include an explicit warning about impact or reversibility.
The reference explicitly promotes permanent on-chain storage and a payment-gated inscription flow, but it does not prominently warn that uploaded content becomes publicly accessible and effectively irreversible once published. In this skill context, that omission is dangerous because developers may integrate the API into user-facing flows and cause users to pay to permanently expose sensitive or regulated data without informed consent.
The skill presents hanLock as providing "lightweight privacy" for data written on-chain, but it does not clearly warn that on-chain data is publicly visible forever and that password-based encoding is not equivalent to strong cryptographic encryption. This can mislead users into storing secrets, credentials, or sensitive personal data under a false assumption of confidentiality, especially in an immutable public blockchain context.
The reference states that arbitrary data is converted into Korean Hangul syllables, effectively forcing a specific script representation. Because no user choice or opt-in is offered, this can be a language/locale policy concern where users may not expect or want Korean-script output.
No suspicious patterns detected.