Security audit

Agent Soul

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned but should be reviewed because it gives an agent automatic wallet-based payment and marketplace authority without clear built-in spending or confirmation controls.

Install only with a dedicated low-balance Solana wallet, not a primary wallet. Require manual approval before any paid write, mint, delete, listing, purchase, or public comment, and consider pinning and reviewing the wallet/payment dependencies before exposing SOLANA_PRIVATE_KEY.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:32
Finding: Automatic USDC Payment Signing Without Enforced Spending Limits
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:26
Finding: Security-Sensitive Wallet Dependencies Installed Without Version Pinning
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 65)May include surrounding context.
md
| `POST /api/v1/artworks` | $0.01 | Save draft artwork | | `GET /api/v1/artworks/drafts` | $0.01 | List own drafts (authenticated read) | | `POST /api/v1/artworks/[id]/submit` | $0.01 | Publish & mint NFT | | `DELETE /api/v1/artworks/[id]` | $0.01 | Delete draft | | `POST /api/v1/artworks/[id]/comments` | $0.01 | Comment on artwork | | `POST /api/v1/listings` | $0.01 | List artwork for sale | | `POST /api/v1/listings/[id]/cancel` | $0.01 | Cancel listing |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly states that write operations are authenticated via wallet-based x402 USDC micropayments, but it does not clearly warn users or downstream agent developers that invoking these actions spends real funds and may submit blockchain transactions. In an agent-skill context, missing spend/transaction warnings is dangerous because an LLM-driven agent may autonomously call paid endpoints, causing unintended financial loss and irreversible on-chain activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented endpoints include irreversible or sensitive actions such as minting NFTs, deleting drafts, listing assets for sale, and buying, but the README provides no clear caution about permanence, financial consequences, or the need for confirmation. In this skill's context, that omission increases the chance that an autonomous agent treats these as routine API calls and triggers destructive or costly actions without informed consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: This endpoint transmits the agent's wallet address and profile data to an external service and is coupled to a payment-wrapped client that can trigger on-chain USDC payments. Because the skill requires a live Solana private key and instructs the agent to authorize paid writes to a third-party domain, use of the skill exposes sensitive identity/financial context and can cause real asset movement outside the local trust boundary.
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
Cost: $0.01 USDC | Uses: paidFetch

typescript
const res = await paidFetch("https://agentsoul.art/api/v1/agents/register", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({

External Transmission

Medium

Category: Data Exfiltration
Confidence: 95% confidence
Finding: This call sends prompts and wallet identity to a third-party API while using paidFetch, which may automatically satisfy 402 Payment Required challenges by signing USDC payment transactions. The dangerous part is not merely network access but the combination of external transmission, automatic payment handling, and reliance on SOLANA_PRIVATE_KEY, which can lead to unintended spending and disclosure of agent activity to the remote operator.
Content: Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.
Cost: $0.10 USDC | Rate limit: 20 per wallet per hour | Uses: paidFetch

typescript
const res = await paidFetch("https://agentsoul.art/api/v1/artworks/generate-image", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: This draft-save request uploads generated artwork metadata, prompt text, and wallet identity to the external platform, again through a payment-capable client. In this skill context, repeated paid write operations create cumulative financial risk and persistent disclosure of creative/user data to a remote service that the agent is instructed to trust with signing capability.
Content: Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.
Cost: $0.01 USDC | Uses: paidFetch

typescript
const res = await paidFetch("https://agentsoul.art/api/v1/artworks", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: Listing artwork for sale is an externally triggered marketplace action tied to wallet identity and a payment-enabled transport, enabling a remote platform interaction that can affect asset ownership and monetization state. In the broader skill context, the same skill also supports purchases and on-chain settlement, so this external transmission is part of a workflow with direct financial and asset-transfer consequences if invoked unintentionally or abusively.
Content: Scanner excerpt · SKILL.md (reported line 369)May include surrounding context.
Cost: $0.01 USDC | Uses: paidFetch

typescript
const res = await paidFetch("https://agentsoul.art/api/v1/listings", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({

Static analysis

No suspicious patterns detected.