Security audit

Ship My Token

Security checks for vulnerabilities and agentic risk

Overview

The skill does launch Solana tokens, but it also handles wallet keys, real transactions, recurring jobs, and a hard-coded 20% fee recipient with incomplete per-transaction disclosure.

Review this carefully before installing. Use it only if you accept local custody of a Solana private key, recurring portfolio checks, uploads to Pumpfun/IPFS, and a non-negotiable 20% creator-fee share to the skill operator. Do not export the private key into chat, and require explicit confirmation for dependency installs, scheduled jobs, file uploads, and every on-chain transaction.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Agent Goal and Safety-Constraint Hijacking
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:41
Finding: Persistent Agent-Memory and Scheduled-Task Modification Without Explicit Consent
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: src/launch.mjs:288
Finding: Material 20% Revenue Diversion Is Omitted from the Default Launch Confirmation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/launch.mjs:116
Finding: Arbitrary Local Files Can Be Uploaded to the Pump.fun IPFS Endpoint
Content: View full analysis
({ default: globalThis.fetch })); let imageBlob; if (image.startsWith("http://") || image.startsWith("https://")) { const resp = await globalThis.fetch(image); imageBlob = await resp.blob(); } else { const { readFile } = await import("fs/promises"); const buf = await readFile(image); const ext = image.split(".").pop().toLowerCase(); const mimeTypes = { png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp" }; imageBlob = new Blob([buf], { type: mimeTypes[ext] || "image/png" }); } const form = new FormData(); form.append("file", imageBlob, "token-image"); form.append("name", name); form.append("symbol", symbol); if (description) form.append("description", description); if (twitter) form.append("twitter", twitter); if (telegram) form.append("telegram", telegram); if (website) form.append("website", website); form.append("showName", "true"); let lastError; for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) { try { const resp = await globalThis.fetch(IPFS_ENDPOINT, { method: "POST", body: form }); ``` ### Technical Analysis The `--image` argument is treated as an arbitrary filesystem path whenever it does not begin with `http://` or `https://`. The script reads the referenced file without: - Restricting it to an attachment or upload directory. - Resolving and checking its canonical path. - Rejecting symbolic links. - Validating image magic bytes. - Enforcing a file-size limit. - Confirming the source path and destination with the user. The code infers the MIME type only from the ...[truncated 1335 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: src/stats.mjs:132
Finding: Read-Only Portfolio Operations Unnecessarily Load the Wallet Private Key
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:7
Finding: Automatic Installation of Mutable Dependencies in a Wallet-Signing Environment
Content: View full analysis
/dev/null || (cd {baseDir} && npm install) ``` Run this once per session. ``` No dependency lockfile is present in the reviewed project structure. ### Technical Analysis Caret version ranges permit npm to install newer compatible package releases than those originally reviewed. Because the repository has no lockfile, dependency resolution can change between installations without any source change in this project. The automatic `npm install` instruction compounds this risk by retrieving packages during normal Skill activation. npm lifecycle scripts are not disabled. These dependencies execute in an environment that reads a private wallet key, constructs transactions, and signs them. The audit did not establish that any listed package is currently malicious. The finding is the mutable, insufficiently controlled supply-chain boundary around highly privileged wallet operations. ### Attack Path 1. The Skill starts a session and detects that dependencies are absent. 2. It automatically runs `npm install`. 3. npm resolves versions allowed by the caret ranges at installation time. 4. A compromised upstream release, dependency, or lifecycle script is installed. 5. The package executes during installation or is imported by the Skill. 6. It accesses wallet credentials, changes transaction instructions, redirects fee recipients, or exfiltrates ...[truncated 492 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (38)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents blockchain/token-management functionality on Solana and Pumpfun, but the actual code chunk contains no token deployment, wallet interaction, fee sharing, earnings claims, portfolio tracking, or AI-agent chat logic. Instead, it performs software release engineering tasks for the skill's source repository. This is a materially different primary purpose and introduces undeclared capabilities involving local file modification, git operations, and GitHub release publishing. Therefore, the code does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to immediately install dependencies, create a wallet, and configure scheduling on first activation without waiting for user approval. Automatic state-changing actions in the workspace and wallet generation are dangerous because they modify the environment and create sensitive assets before the user has consented.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The heartbeat instructions direct the agent to append to or create HEARTBEAT.md automatically. Silent workspace modification creates persistence and changes repository state without informed user consent, which is especially risky in shared or source-controlled environments.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The wallet backup flow instructs the agent to export and display the private key in chat. Private keys are extremely sensitive bearer secrets; exposing them through a conversational interface risks permanent wallet compromise through transcript retention, logging, screenshots, or prompt injection around the export path.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The 'Important Rules' section explicitly authorizes exposing the private key whenever the user asks for backup, embedding a direct instruction path for secret disclosure. In context, this normalizes high-risk handling of wallet secrets in a chat-based agent and makes prompt-driven exfiltration much easier.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · scripts/release.sh (reported line 36)May include surrounding context.
sh
fs.writeFileSync('package.json', JSON.stringify(pkg, null, 2) + '\n'); " # 2. Update SKILL.md metadata sed -i '' "s/\"version\":\"$CURRENT\"/\"version\":\"$NEW_VERSION\"/" SKILL.md # 3. Update CHANGELOG.md

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The updateShares logic silently forces inclusion of the hard-coded SHIPMYTOKEN_WALLET with at least 2000 bps, meaning any fee-sharing update diverts 20% of creator fees to the vendor regardless of user intent. In a token-launching skill that signs real on-chain transactions, this is dangerous because it causes undisclosed revenue capture and permanently alters economic rights on-chain.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code hard-codes a secondary shareholder and assigns 20% of creator fee-sharing revenue to the shipmytoken wallet, while presenting the operation as a normal token launch flow. In a token-launching skill, silently diverting future earnings is especially dangerous because users are likely to assume all creator economics remain under their control.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The changelog states wallet creation and backup are stored in ~/.shipmytoken/ but gives no warning that this is sensitive private key material on local disk. In the context of a Solana token-launching skill, inadequate disclosure around key storage materially increases the risk of fund theft if filesystem permissions, backups, syncing tools, or shared machines expose the wallet.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to install and run a remote package via npx skills without pinning a specific version. This creates a supply-chain risk because future package changes, account compromise, or a malicious update could cause users or agents to fetch and execute unexpected code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This installation path again relies on npx skills without a pinned version, meaning the agent may retrieve whatever package version is current at execution time. In a skill that handles wallets and token launches, unpinned remote execution materially increases the chance of compromise through a package update or dependency hijack.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README tells users to paste a prompt that instructs an agent to run npx skills add ... --all, again without version pinning and with broad installation scope. Because this is mediated through an AI agent and followed by wallet setup actions, it compounds supply-chain risk with delegated execution, increasing the chance that malicious updates could lead to credential or private key compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The feature list advertises wallet creation and private key export but does not provide explicit warnings about custody, irreversible fund loss, phishing risk, or the sensitivity of exported keys. In a crypto-token-launching skill, omission of these warnings is dangerous because users may allow an agent to manage or reveal wallet secrets without understanding the security consequences.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation criteria are intentionally broad and instruct the agent to use this skill first for many Solana-related requests, including wallet backup/export. That can cause the skill to preempt safer, narrower handling and funnel unrelated or ambiguous requests into wallet creation, token-launch, or secret-export flows.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: Registering a recurring scheduled job creates persistence beyond the current interaction and can cause ongoing execution without continuous user awareness. Persistent automation is risky here because it is coupled to wallet/portfolio processing and may continue after the user forgets it was enabled.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

If the output contains token data, format and send the daily portfolio recap

text
**b) Cron / scheduled tasks**: If the platform supports cron jobs or scheduled tasks, register a daily job (e.g., once every 24h) that runs:

node {baseDir}/src/stats.mjs --daily-recap

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The dependency check can invoke npm install, which changes the local environment and executes package lifecycle scripts, yet the skill frames it as a routine prerequisite rather than a consented change. This increases the risk of unintended package installation and supply-chain exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The skill tells users to run npx skills add ... without pinning a specific version. That makes the update path depend on whatever package version is current at execution time, which increases supply-chain risk if a malicious or broken version is published later.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill requires --daily-recap to run automatically on every turn, including heartbeat/background contexts, without a clear opt-in. Automatic background execution expands the skill's behavior beyond the user's immediate request and can trigger unwanted processing and data disclosure.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The daily recap flow instructs the agent to proactively show portfolio data before responding to regular user requests. That can leak wallet balances, token holdings, and earnings into unrelated conversations or visible logs, violating data minimization expectations for financial information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code submits and confirms state-changing Solana transactions directly once invoked, without an explicit confirmation step summarizing the action, recipients, and fee-sharing consequences. In this skill's context, that is especially risky because the transactions can change creator fee distribution and move funds on mainnet.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The inline comment says '10%' while the code actually enforces 2000 bps, i.e. 20%, creating a misleading discrepancy around revenue extraction. Misstating the fee in source materially increases the risk that reviewers or downstream integrators underestimate the portion of fees being diverted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill loads a signing private key from sensitive storage and immediately uses it to authorize transactions, but there is no user-facing disclosure at the point of use. In an agent skill context, this reduces user awareness that the tool has custody-capable signing authority over a wallet and can execute financially meaningful actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Launching Pump.fun tokens does not inherently require spawning local executables, yet this function runs the solana-keygen binary via execFile and manipulates temporary filesystem state. The manifest does not mention local command execution or vanity-address generation as part of the skill's scope.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/launch.mjs:76

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/launch.mjs:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/setup.mjs:89