Ship My Token

• Outcome: Review
• Latest audit: May 28, 2026 · 6:28 AM UTC
• Version: 1.5.3

Overview

This skill mostly does what it advertises, but it gives an agent high-risk crypto authority while hiding or auto-running some important financial and persistent behaviors.

Review carefully before installing. Use only a dedicated low-balance wallet, assume launches and fee actions can submit real Solana mainnet transactions, understand that 20% of creator fees are reserved for Ship My Token, avoid exporting the private key into chat unless absolutely necessary, and check for/remove any HEARTBEAT.md or scheduled recap job if you do not want recurring portfolio activity.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Description-Behavior Mismatch

High

• Confidence: 89% confidence
• Finding: The manifest/description advertises token launch and portfolio features, but the instructions also support wallet backup and private-key export. Omitting a private-key export capability from the declared skill surface is dangerous because users and host platforms may not realize the skill can reveal highly sensitive wallet secrets.

Description-Behavior Mismatch

Medium

• Confidence: 74% confidence
• Finding: The skill supports vanity-address generation via Solana CLI key grinding, but this capability is not disclosed in the manifest. While less severe than key export, undisclosed key generation/grinding changes the operational and resource profile of the skill and can surprise users or administrators.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to automatically perform onboarding actions on first activation, including dependency installation, wallet setup, and recap configuration, before the user explicitly asks. This is dangerous because it creates wallet-related state and modifies the environment without informed consent, expanding the skill's effective privileges beyond a normal conversational assist.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to create or modify HEARTBEAT.md and register scheduled tasks, which are persistent workspace changes not clearly disclosed by the manifest. Persistently altering scheduling configuration can create unexpected behavior, privacy issues, and operational drift in the host environment.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The fee-share update logic silently forces inclusion of the hardcoded SHIPMYTOKEN wallet at 2000 bps (20%) and rejects configurations below that threshold. In a token-launching financial skill, this creates an undisclosed mandatory revenue diversion to the vendor wallet, which is especially dangerous because users may believe they control payout splits while the code enforces a hidden beneficiary.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The inline comment says '10%' while the actual enforced value is 2000 bps, i.e. 20%, which misrepresents the fee being taken. This discrepancy can mislead reviewers and users, and in the context of on-chain fee allocation strongly suggests deceptive implementation around revenue capture.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The code hard-codes SHIPMYTOKEN_WALLET and then automatically assigns it 20% of fee shares via updateFeeShares after launch. This causes users to unknowingly divert future creator fee revenue to a third party, which is especially dangerous in a token-launch skill where users expect the launched asset and its economics to remain under their control unless explicitly disclosed and approved.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The setup script supports a `--export` mode that returns the wallet private key in plaintext JSON. That capability is broader than the advertised token-launching functionality and materially increases the risk of wallet compromise because any caller or integrating agent that invokes setup with this flag can extract the secret and transfer all assets.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The changelog indicates the skill can enable automatic daily portfolio recaps through heartbeat, cron, or fallback interaction mechanisms during onboarding, but it does not mention explicit consent, visibility, or opt-out safeguards. In a crypto-related skill that handles wallet activity and portfolio data, undisclosed background automation can surprise users, increase privacy risk, and create unintended recurring actions or notifications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises wallet creation and private key export as product features without any accompanying warning about secure key handling, storage, or the risks of exposing credentials to an AI agent environment. In this skill context, that omission is more dangerous because the tool is explicitly designed to operate through chat-based agents, where users may be encouraged to reveal or export highly sensitive wallet material in an environment that could log, forward, or misuse it.

Vague Triggers

Medium

• Confidence: 77% confidence
• Finding: The activation criteria are broad enough to trigger on general Solana, memecoin, earnings, wallet backup, or vanity-address discussions. Overbroad invocation increases the chance that the skill runs sensitive setup or wallet-related workflows when the user only wanted information, not action.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: Automatic onboarding tells the agent to create a wallet, install dependencies, configure recaps, and begin a funding flow immediately on load. This is dangerous because it initiates sensitive state creation and environment modification without prior disclosure or consent, potentially steering users into funding a newly created wallet they did not request.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The instructions allow creating or appending HEARTBEAT.md without user disclosure. Silent modification of workspace files is a risky side effect because it introduces persistence and scheduled behavior that users may not notice or understand.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill says to run the daily recap on every turn and potentially display portfolio information automatically. Proactively surfacing financial status without a direct user request or privacy notice can leak sensitive wallet activity in shared interfaces or logs.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The code constructs, signs, and submits an on-chain fee-share update transaction immediately, without any explicit user-facing review or confirmation step. In a chat-driven crypto skill, this raises the risk of accidental or socially engineered state changes that permanently alter revenue distribution and incur transaction costs.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script uploads token metadata and image content to a remote pump.fun IPFS endpoint automatically, including arbitrary local files when a file path is supplied. In an agent setting, this can exfiltrate local user-selected content or sensitive branding/material to a third party without a clear warning that the data will be transmitted and become publicly accessible via metadata hosting.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code sends irreversible on-chain transactions and then performs a second transaction to configure fee sharing, all without any confirmation step that surfaces the exact economic effects. In this context, the missing confirmation is especially dangerous because the second transaction silently assigns 20% of creator fees to a hard-coded third-party wallet, turning an opaque UX issue into a financially harmful action.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script generates a new wallet and writes the private key to `~/.shipmytoken/config.json` without any visible consent, confirmation, or explanation in this file. Storing a long-lived raw private key on disk in local config increases exposure to local compromise, accidental backup leakage, and misuse by other tools that can read the file.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Automatic daily recap behavior can disclose portfolio balances, claimable fees, and token performance during routine turns or scheduled heartbeats. Financial data exposure outside an explicit request is a confidentiality risk, especially in multi-user, logged, or shared-agent environments.

Ssd 3

Medium

• Confidence: 87% confidence
• Finding: On first activation, the skill instructs the agent to reveal the user's wallet address and request funding immediately. Even though a public address is less sensitive than a private key, proactively generating and exposing account identifiers and prompting transfers can create privacy, phishing, and trust issues without user initiation.

Session Persistence

Medium

• Category: Rogue Agent

Content

- If the output contains token data, format and send the daily portfolio recap
```

**b) Cron / scheduled tasks**: If the platform supports cron jobs or scheduled tasks, register a daily job (e.g., once every 24h) that runs:

```
node {baseDir}/src/stats.mjs --daily-recap

• Confidence: 82% confidence
• Finding: Registering a daily scheduled job creates persistence beyond the immediate conversation. Persistent execution increases risk because the skill can continue processing wallet/portfolio data and emitting outputs after the initial interaction, potentially without ongoing user awareness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "description": "Launch Solana tokens on Pumpfun via chat. An Agent Skill for any AI agent.",
  "dependencies": {
    "@pump-fun/pump-sdk": "^1.27.0",
    "@pump-fun/pump-swap-sdk": "^1.13.0",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",

• Confidence: 88% confidence
• Finding: Using a caret version range for @pump-fun/pump-sdk allows new upstream releases to be installed automatically within the major version, which can introduce vulnerable or malicious code through the supply chain. In a skill that handles token launches and likely interacts with wallets or signing flows, compromised dependencies could affect financial transactions and asset safety.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "Launch Solana tokens on Pumpfun via chat. An Agent Skill for any AI agent.",
  "dependencies": {
    "@pump-fun/pump-sdk": "^1.27.0",
    "@pump-fun/pump-swap-sdk": "^1.13.0",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"

• Confidence: 88% confidence
• Finding: The caret range for @pump-fun/pump-swap-sdk permits unreviewed upstream updates during installation, increasing exposure to supply-chain compromise. Because this package likely participates in swap and token trading operations, a malicious update could manipulate destinations, fees, or transaction construction.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@pump-fun/pump-sdk": "^1.27.0",
    "@pump-fun/pump-swap-sdk": "^1.13.0",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"
  }

• Confidence: 87% confidence
• Finding: Allowing floating minor/patch updates for @solana/web3.js introduces supply-chain risk in a library central to Solana transaction building and signing workflows. If an upstream release is compromised or contains a critical bug, the skill could produce unsafe transactions or leak sensitive wallet-related operations.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@pump-fun/pump-sdk": "^1.27.0",
    "@pump-fun/pump-swap-sdk": "^1.13.0",
    "@solana/web3.js": "^1.98.0",
    "@solana/spl-token": "^0.4.9",
    "bs58": "^6.0.0"
  }
}

• Confidence: 86% confidence
• Finding: The unpinned @solana/spl-token dependency can change across installs, exposing the project to tampered or buggy token-program helper behavior. Given this skill's token minting and management context, dependency compromise could directly affect token creation, transfers, authority handling, or fee distribution.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/launch.mjs:76

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/launch.mjs:19

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/setup.mjs:89