Tokenmonkey Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:05 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for Solana wagering, but it asks the agent to use a raw wallet private key with an unpinned third-party SDK for value-moving gambling actions.

Review before installing. Use only a dedicated low-value devnet wallet, never a primary or reused wallet key. Pin and review the SDK version where possible, avoid exposing unrelated secrets to the agent process, and require explicit user approval for every wager or transaction.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:12

Finding

Unpinned Third-Party SDK Receives Access to a Private-Key-Backed Wallet

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-14 and 25-35
Vulnerability Type: Unpinned third-party dependency with access to sensitive wallet credentials
Risk Level: High

The Skill declares and installs tokenmonkey-sdk without an exact version or integrity constraint:

yaml

install:
  - kind: node
    package: tokenmonkey-sdk
    bins: []

It repeats the unpinned installation instruction and passes a private-key-backed signer to the installed SDK:

typescript

import { TokenMonkey } from 'tokenmonkey-sdk'
import { Keypair } from '@solana/web3.js'
import bs58 from 'bs58'

// Load your keypair
const keypair = Keypair.fromSecretKey(bs58.decode(process.env.SOLANA_PRIVATE_KEY))
const tm = new TokenMonkey(keypair)

Technical Analysis

The package declaration and installation command omit an exact version and lockfile integrity value. Consequently, the code installed under the trusted package name may vary between installations. The audited project contains only SKILL.md; it does not include the SDK source, a package lockfile, an integrity hash, or another mechanism that permits verification of the executed dependency.

npm packages may also execute lifecycle scripts during installation. At runtime, the SDK receives a Keypair constructed from the complete SOLANA_PRIVATE_KEY, giving SDK code access to signing capabilities. If a future package release, compromised publisher account, dependency, or installation artifact is malicious, it could read the environment, inspect or misuse the supplied keypair, transmit secret material, or create unauthorized Solana transactions.

This finding establishes an unsafe supply-chain trust boundary, not that the current published SDK is proven malicious.

Attack Path

1. An attacker compromises the npm publisher account, package distribution path, or a transitive dependency used by tokenmonkey-sdk, or causes an unsafe release t ...[truncated 1323 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin tokenmonkey-sdk to a specifically reviewed version rather than allowing npm to resolve a changing release.
2. Include a lockfile with verified registry integrity hashes and enforce reproducible installation with npm ci.
3. Audit the SDK and its transitive dependency tree before deployment; repeat the review for every proposed upgrade.
4. Disable npm lifecycle scripts where compatible, such as by using npm ci --ignore-scripts, and explicitly review any package that requires such scripts.
5. Vendor or bundle reviewable SDK source when feasible so the executed implementation is included in the audited artifact.
6. Do not expose a general-purpose or high-value wallet private key to the agent process. Use a dedicated, low-balance devnet wallet with no key reuse.
7. Prefer a constrained external signer or transaction-approval boundary that validates network, program IDs, token mints, recipients, amounts, and maximum wager limits before signing.
8. Restrict process access to unrelated secrets, files, and network destinations, and monitor wallet activity for unexpected transactions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to load and use a raw Solana private key from the SOLANA_PRIVATE_KEY environment variable to create a signing keypair, but it does not prominently warn that this credential grants full control of the wallet and can authorize irreversible on-chain transactions. In this skill’s context, the key is then used for gambling and bankroll management actions, which increases the chance of unintended fund loss if an agent is misconfigured, over-permissioned, or tricked into executing wagering operations.

Content

No source excerpt is available for this finding.