Sol on X

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

This is a text-only Solana social-growth helper with broad routing and edgy CT tone, but it does not install code, persist itself, or take account actions.

Install this if you want Solana/X content strategy and draft generation. Be aware it may activate on fairly generic social-growth prompts and will push a CT-native, persuasive style by default. Review any generated token, market, or people-related claims before posting, and only connect X/Twitter or on-chain MCP tools with permissions you actually intend to grant.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger scope is extremely broad and auto-invokes on generic requests like tweet ideas, CT posts, growth on X, or engagement farming. That can cause inappropriate routing, suppress user choice, and increase the chance that manipulative or risky social-growth behaviors are applied by default outside a clearly bounded Solana/crypto context.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

Do not lecture about Solana culture. Do not introduce the skill. Just route.

• Confidence: 85% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The skill hard-codes a default voice and stylistic rules such as lowercase-by-default, high-confidence tone, and no corporate phrasing without requiring user opt-in. While not directly a security exploit, this can override user intent and push persuasive or deceptive-seeming output styles that may be inappropriate in some contexts.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The file sets a default communication style for generated content ('lowercase', 'terse', 'no marketing voice') without indicating that this should be applied only when the user requests CT-native tone. That can override user intent or make outputs impersonate an in-group register, increasing risks of deceptive social engineering, manipulative engagement farming, or unwanted persona shaping in a crypto context.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrase "what's hot" is overly broad and can cause the skill to activate for generic trend-related requests that are not actually about Solana narrative tracking. In an agent environment, broad unintended invocation can route user queries to the wrong skill, producing irrelevant guidance and increasing the chance of confusing or policy-inappropriate behavior.

Unbounded Output

Medium

• Category: Output Handling

Content

Markers of high repostability:
- self-contained (no thread needed to understand)
- screenshot-shaped (≤240 char, no truncation)
- carries a single clean claim
- works without the author's context

• Confidence: 60% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Static analysis

No suspicious patterns detected.