Security audit

Pg Buy

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ProxyGate buying guide, but it can steer ordinary API requests into paid external proxy use and lacks strong confirmation guidance for real USDC transactions.

Install only if you intend to use ProxyGate for paid API access. Before using it, require explicit approval for every deposit, withdrawal, withdraw-all, and paid proxy request; do not send secrets or confidential payloads through proxied APIs; and avoid custom gateway or RPC endpoints unless you trust and approve them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:2
Finding: Overbroad Skill Activation Redirects Generic API Requests Through a Paid Third-Party Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:19
Finding: Deposit and Withdrawal Workflow Lacks Mandatory Transaction Confirmation
Content: View full analysis
``` ``` ### Technical Analysis The workflow handles real USDC deposits and withdrawals but does not establish a mandatory confirmation boundary before executing a transaction. The statement “If 0 or insufficient, deposit first” can be interpreted by an autonomous agent as authorization to fund the account merely because a requested API operation lacks sufficient balance. The documented commands do not require the workflow to verify and present the following before execution: - Selected wallet and public address. - Solana network and RPC endpoint. - Deposit or withdrawal amount. - Withdrawal destination. - Estimated network fees. - Available balance and settlement restrictions. - Dry-run or transaction simulation results. - Explicit approval for the specific transaction. The unparameterized `proxygate withdraw` command is particularly sensitive because it withdraws all available funds. API-call approval does not inherently constitute approval to move cryptocurrency. ### Attack Path 1. A user requests an API operation without separately authorizing a financial ...[truncated 1111 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/commands.md:5
Finding: Unrestricted Gateway and RPC Overrides Can Expose Sensitive Traffic to Untrusted Endpoints
Content: View full analysis
` — Override gateway URL (default: https://gateway.proxygate.ai) - `--keypair ` — Path to Solana keypair JSON file - `--api-key ` — Override API key - `--json` — Machine-readable JSON output - `--no-color` — Disable colored output ``` The deposit workflow also supports an arbitrary RPC endpoint: ```markdown ## Wallet & Balance ```bash proxygate balance # USDC balance (total, pending, available, cooldown) proxygate deposit -a 5000000 # deposit 5 USDC (1 USDC = 1,000,000 lamports) proxygate deposit -a 1000000 --rpc # custom Solana RPC proxygate deposit -a 100000 --dry-run # preview without sending ``` ``` ### Technical Analysis The command reference permits gateway and Solana RPC endpoint overrides but does not prescribe endpoint validation, transport security, hostname allowlisting, or confirmation for non-default endpoints. If an untrusted gateway is selected, authentication material and proxied request content may be transmitted to an attacker-controlled service, depending on the CLI's authentication behavior. The gateway could also return manipulated API listings, prices, service metadata, or responses. A malicious or compromised Solana RPC endpoint normally does not need access to the wallet's private key to create risk. It can observe submitted signed transactions and account queries, provide misleading chain state, suppress transactions, or return deceptive simulation and confirmation results. The documentation places sensitive options such as `--api-key`, `--keypair`, `--gateway`, and `--rpc` together without explaining that endpoint overrides change the trust boundary. ### Attack Path 1. An attacker-controlle ...[truncated 1285 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill’s trigger phrases are extremely broad and include generic prompts like "make an API call," "find an API," and "search APIs," which can cause the skill to activate in contexts the user did not intend. In this skill, unintended activation is more dangerous than usual because the workflow includes financial actions (USDC deposits/withdrawals) and external network requests through third-party APIs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill describes deposits, withdrawals, paid proxy requests, and interaction with external APIs without clear user-facing warnings about spending funds, contacting third-party services, or possible data exposure. In this context, the omission matters because the skill is explicitly designed to move USDC and transmit request payloads off-platform, increasing the chance of accidental spending or disclosure if invoked without strong consent cues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The wallet commands document deposit and withdrawal operations affecting real USDC balances, but they do not include explicit warnings about irreversible or value-bearing financial effects. In an agent context, this increases the risk that a user or autonomous workflow triggers deposits, withdrawals, or wallet generation/recovery actions without fully understanding the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The proxy request examples encourage sending arbitrary paths and request bodies to external services, including streaming, without clearly warning that prompts, payloads, headers, and possibly sensitive user data leave the local environment. In an agent workflow, this can cause inadvertent exfiltration of secrets or confidential content to third-party APIs simply by following the documented commands.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill is described as buyer-focused, but the command reference exposes substantial seller-side and job marketplace operations such as listing management, tunnel/development exposure, and escrow-style job actions. In an agent setting, this broadens the reachable action surface beyond the declared purpose and can lead to unintended destructive, financial, or publishing actions if the agent invokes commands outside the expected buying workflow.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.