Security audit

Sfaeflow Solana Skill

Security checks for vulnerabilities and agentic risk

Overview

This payment skill is mostly coherent with its stated Solana purpose, but its scripts handle payment and wallet inputs in unsafe ways that could allow local code execution or unintended transfers.

Install only after the publisher replaces inline node -e/ts-node -e code with checked-in scripts that parse arguments safely, pins dependencies with a lockfile, validates recipient and amount before loading the keypair, protects the keypair with restrictive permissions or a safer signer, and adds clear operator controls such as dry-run, confirmation, and spending-policy guidance.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/save_config.sh:27
Finding: JavaScript Code Injection Through the Wallet Owner Argument
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/execute_payment.sh:34
Finding: Arbitrary JavaScript Execution Through Payment Arguments
Content: View full analysis
{ const config = JSON.parse(fs.readFileSync('$CONFIG_DIR/config.json', 'utf8')); const idl = JSON.parse(fs.readFileSync('target/idl/safeflow_solana.json', 'utf8')); const keypairData = JSON.parse(fs.readFileSync(config.keypairPath, 'utf8')); const keypair = Keypair.fromSecretKey(Uint8Array.from(keypairData)); const walletOwner = new PublicKey('${WALLET_OWNER_OVERRIDE}' || config.walletOwner); const clusterUrl = config.cluster === 'devnet' ? 'https://api.devnet.solana.com' : config.cluster === 'mainnet' ? 'https://api.mainnet-beta.solana.com' : 'http://localhost:8899'; const { SafeFlowAgent } = require('./sdk/src/agent'); const agent = new SafeFlowAgent({ connection: new Connection(clusterUrl, 'confirmed'), programId: new PublicKey(config.programId), keypair, idl, }); if (${QUERY_MODE}) { const session = await agent.getSessionInfo(walletOwner); const vault = await agent.getVaultBalance(walletOwner); console.log('Session Status:'); console.log(' Active :', session.isActive); console.log(' Remaining :', session.remainingBudget.toString(), 'lamports'); console.log(' Total Spent :', session.totalSpent.toString(), 'lamports'); console.log(' Max Total :', session.maxSpendTotal.toString(), 'lamports'); console.log(' Rate Limit :', session.maxSpendPerSecond.toString(), 'lamports/s'); console.log(' Expires At :', new Date(session.expiresAt.toNumber() * 1000).toISOString()); console.log(' Vault Balance :', vault / LA ...[truncated 2889 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/execute_payment.sh:34
Finding: Unpinned Runtime Package Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly states that the agent generates and stores a Solana keypair locally in .safeflow/agent-keypair.json, but it provides no guidance on secure storage, filesystem permissions, encryption, rotation, or avoiding accidental exposure through logs, backups, or source control. Because this key authorizes spending within the session cap, compromise of the local private key could let an attacker execute unauthorized payments up to the configured limits.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx ts-node without pinning an exact version allows the script to resolve and execute whatever package version is available from the local environment or registry at runtime. In a payment-execution skill, this creates a supply-chain execution risk: a malicious or compromised ts-node package could run arbitrary code, exfiltrate the Solana keypair loaded from config.keypairPath, or alter payment behavior before the transfer is submitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script performs a real on-chain payment immediately after parsing CLI arguments, with no interactive confirmation, preview, or secondary approval step. In the context of an autonomous payment skill that holds a usable keypair and session budget, operator error, prompt/agent misuse, or parameter tampering could cause irreversible transfers to an unintended recipient.
Content: No source excerpt is available for this finding.