let's send it

• Outcome: Review
• Latest audit: May 28, 2026, 2:34 AM
• Version:
  1.0.0

Overview

The skill appears to do what it says, but it handles real Solana fundraising transactions with fee and safety disclosures that users should review carefully before use.

Install only if you understand the platform economics and are prepared to treat every commit, launch, and start action as a real financial operation. Require human confirmation for any SOL transfer or fundraise launch, verify vault addresses and amounts out of band, protect and rotate the bearer API key, and clarify whether costs are deducted from the raised pool before relying on the fee documentation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document repeatedly states that committed SOL is 'never affected by fees,' but the worked example shows raised SOL being reduced by platform operations, vesting setup, and transaction costs before the dev buy. This is materially misleading financial documentation: participants may believe 100% of contributed SOL is used for token purchase when in fact pre-launch deductions reduce purchasing power and token allocation outcomes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The summary and rationale sections reinforce the same inaccurate claim that participant SOL is never affected, despite earlier numeric examples showing reductions from the raised pool before tokens are purchased. In a token-launch/fundraising context, this inconsistency can mislead users about economics, dilute informed consent, and create legal, reputational, and trust risks.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The API documentation describes flows that cause users or agents to send SOL on-chain and then submit transaction signatures, but it does not include prominent warnings that these transactions are irreversible and involve real financial loss if misused or if parameters are wrong. In an agent-integration context, this omission increases the risk that autonomous systems or users execute commits without adequate confirmation, balance checks, destination verification, or human approval.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document promotes token launches, SOL commitments, refunds, and on-chain participation as predictable mechanics but does not warn users about financial loss, volatility, wallet compromise, transaction finality, smart contract risk, or the practical irreversibility of blockchain actions. In a skill aimed at communities and AI agents making programmatic financial decisions, this omission can mislead users into treating risky crypto activity as routine infrastructure rather than high-risk financial behavior.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The quickstart instructs users to export and use a bearer API key but does not warn about protecting it from shell history, accidental logging, screenshots, shared terminals, or insecure .env handling. Because the key authenticates agent actions tied to a social account and wallet context, disclosure could let an attacker query account data and potentially perform authorized platform actions as the user.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The guide tells agents to transfer SOL on-chain and create/start fundraises without prominent warnings that these actions can move real funds, may be irreversible, and may have legal or operational consequences. In an agent context, terse operational instructions can be copied directly into automation, increasing the chance of unintended financial loss or unauthorized launches.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs agents to create token launches and submit SOL-related commit actions, but it does not include clear, explicit warnings that these are real financial operations involving irreversible on-chain transactions and potential loss of funds. In an agent context, this omission is dangerous because a user or autonomous workflow could treat the examples as routine API calls and trigger high-risk blockchain actions without adequate consent, policy gating, or human review.

VirusTotal

61/61 vendors flagged this skill as clean.