Solana Swaps

• Analyzed: May 12, 2026, 3:03 AM
• Findings: 1
• Version: 0.1.0
• Hash: 402029d8f0eb7d6edaa2fab63fff0b6fe32fc43c1b9035a5a1f60e318740ca1e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to perform Solana token swaps, which inherently requires access to the user's private key via `SOLANA_KEYPAIR_PATH` for transaction signing. While the `SKILL.md` file contains strong safety instructions for the AI agent, explicitly forbidding private key exfiltration ('NEVER log, display, or transmit private key contents') and mandating user confirmation for all swaps, a critical component, `scripts/jupiter-swap.mjs`, is invoked with the keypair but its content is not provided for analysis. This unverified component, which directly handles the private key for signing and submitting transactions, introduces a significant blind spot and makes the skill suspicious despite the otherwise robust safety guidelines in `SKILL.md`.