Sol Inbound Watcher Pub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 0.1.0

Overview

This Solana payment watcher is mostly straightforward, but it advertises USDC/token payment detection that the shipped code does not implement, which is risky for payment confirmation workflows.

Review before installing if you need reliable payment confirmation. Use it only for native SOL deposits unless the publisher adds SPL/USDC parsing, and avoid the optional unpinned httpx install or pin dependencies yourself. Configure webhook URLs carefully because emitted events include wallet address and transaction details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 29
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

python3 -m pip install --user httpx 2>/dev/null || true

Technical Analysis

The documented installation command retrieves and installs the latest available httpx package without enforcing a reviewed version or verifying package hashes. Consequently, the code installed by users can change after the skill has been audited.

Python package installation may execute package-controlled build or installation logic. If the package, one of its transitive dependencies, or the package distribution channel is compromised, following these instructions could execute unreviewed code with the privileges of the user running pip.

The command also redirects standard error to /dev/null and forces a successful shell status with || true. This hides package resolution, integrity, and installation failures that could otherwise alert users to unexpected behavior.

The script already contains a standard-library urllib fallback when httpx is unavailable, so installing this dependency is not required for the skill's core operation.

Attack Path

1. An attacker compromises an applicable package release, transitive dependency, maintainer account, or package distribution path.
2. A user follows the installation instructions in SKILL.md.
3. pip resolves and downloads the current package artifacts without a version lock or required hashes.
4. Package-controlled installation or subsequently imported runtime code executes locally.
5. Error suppression may prevent the user from noticing warnings or abnormal installation behavior.

Impact Assessment

Successful exploitation would execute code with the permissions of the user who runs the installation command. Because --user is specified, the command does not inherently obtain administrative privileges, but malicious code could ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer removing the installation command and relying on the script's existing standard-library urllib implementation.
2. If httpx remains necessary, place an explicitly reviewed version in a locked dependency file rather than installing the unconstrained latest release.
3. Require cryptographic hashes for all resolved artifacts, for example through a fully pinned requirements file used with pip install --require-hashes.
4. Review and pin transitive dependencies as well as the direct dependency.
5. Do not discard installation errors or force a successful exit status. Allow failures and integrity warnings to remain visible and stop setup.
6. Periodically update the lock file through a controlled dependency-review process that includes vulnerability and provenance checks.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior claims SOL/USDC inbound transfer monitoring, but the analysis indicates the implementation only detects native SOL balance increases and also persists state locally without clearly declaring that behavior. This mismatch can cause operators to rely on the skill for payment confirmation it does not actually provide, leading to false assurance, missed USDC payments, and unintended local data persistence.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill performs network access and local file read/write via RPC polling, webhook delivery, and a state file, but it does not declare any tool scope or permissions in the manifest. This creates a trust and review gap: an agent or operator may authorize the skill based on incomplete metadata and unknowingly grant broader capabilities than advertised.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/watch_inbound.py (reported line 33)May include surrounding context.

python

class httpx:  # type: ignore
        @staticmethod
        def post(url: str, json: dict | None = None, timeout: float = 30.0, headers: dict | None = None):
            data = None if json is None else __import__("json").dumps(json).encode()
            req = urllib.request.Request(
                url,
                data=data,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises inbound SOL/USDC transfer detection, but the implementation only checks native lamport balance deltas from preBalances/postBalances. An agent relying on this for payment confirmation could falsely conclude that a USDC payment never arrived, or fail to monitor the asset actually requested, causing missed or incorrect business decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file-level documentation and CLI describe inbound SOL-only monitoring while the skill metadata advertises SOL/USDC support. This inconsistency can mislead operators into deploying the watcher for USDC payment verification even though the code does not support it, increasing the chance of operational security and payment-handling errors.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.