Solana Easy Swap

• Analyzed: May 12, 2026, 4:00 AM
• Findings: 1
• Version: 1.0.1
• Hash: 3c80edb252786cafa2b97451a45b18a914effb97df0388da1ad9a6d274078c4b
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is designed to facilitate Solana token swaps and appears benign. It transparently declares its need to access the user's Solana keypair via `SOLANA_KEYPAIR_PATH` for signing transactions, and explicitly states it does not create, import, or manage keys. The `SKILL.md` and `examples/agent-prompt.md` files contain strong instructions for the AI agent to always seek explicit user confirmation before executing swaps, warn about high price impact, and never auto-retry failed on-chain transactions, indicating a focus on user safety and preventing prompt injection. The `scripts/swap.mjs` code uses standard Solana libraries, validates all user inputs (e.g., mint addresses, amounts), and stores temporary transaction data in a UUID-named file within a `.cache` directory, preventing path traversal or sensitive data exposure. No evidence of data exfiltration, unauthorized persistence, or other malicious intent was found.