Security audit

OpenBurn

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised token buyback-and-burn workflow, but it asks for an unrestricted wallet private key, stores it in plaintext, schedules recurring wallet-signing transactions, and reports wallet activity to an external service.

Review this carefully before installing. Use only a dedicated low-balance wallet, do not paste a primary wallet private key, and avoid running the recurring job unless you are comfortable with automated irreversible transactions and external reporting of wallet activity. Prefer a version that uses a wallet signer or hardware wallet, pins dependencies, validates transactions before signing, supports dry runs, and provides clear stop/remove controls for the schedule.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T06 · System Persistence

Error

Location: SKILL.md:89
Finding: Recurring privileged wallet operations persist across sessions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/burn.ts:377
Finding: Externally supplied Jupiter transaction is signed without instruction validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:52
Finding: Spend-capable wallet private key is stored in a plaintext project file
Content: View full analysis
[!IMPORTANT] > Remind the user that their keys will be stored locally in the `.env` file. 2. **Store Credentials**: Check if the `.env` file exists in the root directory. - If it exists, append the keys. - If not, create it. Format: ```env PUMP_FUN_TOKEN_ADDRESS=... CREATOR_WALLET_PRIVATE_KEY=... JUPITER_API_KEY=... BURN_PERCENTAGE=80 MIN_FEE_TO_BURN=0.1 ``` ``` ```ts // Load environment variables from the root .env file dotenv.config({ path: path.resolve(process.cwd(), ".env") }); ``` ```ts const privateKeyString = process.env.CREATOR_WALLET_PRIVATE_KEY; if (!privateKeyString) { console.error("Error: CREATOR_WALLET_PRIVATE_KEY is not set in .env"); process.exit(1); } ``` ```ts // Decode private key let secretKey: Uint8Array; try { if (privateKeyString.startsWith("[") && privateKeyString.endsWith("]")) { secretKey = Uint8Array.from(JSON.parse(privateKeyString)); } else { // Try Base58 decoding secretKey = bs58.decode(privateKeyString); } } catch (e) { const errorMsg = "Error parsing private key. Ensure it is a JSON array of numbers."; console.error(errorMsg); await postToApi("/api/burn/transaction", { status: "failed", error: errorMsg, tokenAddress: tokenAddressString }); process.exit(1); } const payer = Keypair.fromSecretKey(secretKey); ``` ### Technical Analysis The setup instructions require a complete wallet private key to be written into a plaintext `.env` file at the project root. The implementation then reconstructs an unrestricted Solana `Keypair` from that value. The project contains no demonstrated file-perm ...[truncated 1443 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:24
Finding: Unpinned dependencies are installed into a wallet-signing runtime
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/burn.ts:261
Finding: Wallet and transaction telemetry is disclosed to an external Openburn service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly tells the agent to solicit a wallet private key from the user and store it locally as part of normal setup. In the context of a cryptocurrency workflow, this is especially dangerous because possession of the private key grants direct authority over wallet funds, and any leakage, misuse, or future compromise can lead to immediate irreversible asset loss.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/burn.ts (reported line 26)May include surrounding context.
ts
import path from "path"; import bs58 from "bs58"; // Load environment variables from the root .env file dotenv.config({ path: path.resolve(process.cwd(), ".env") }); // API URL for reporting burn transactions

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/burn.ts (reported line 27)May include surrounding context.
ts
import bs58 from "bs58"; // Load environment variables from the root .env file dotenv.config({ path: path.resolve(process.cwd(), ".env") }); // API URL for reporting burn transactions const API_URL = "https://api.openburn.fun";

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/burn.ts (reported line 121)May include surrounding context.
ts
import bs58 from "bs58"; // Load environment variables from the root .env file dotenv.config({ path: path.resolve(process.cwd(), ".env") }); // API URL for reporting burn transactions const API_URL = "https://api.openburn.fun";

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/burn.ts (reported line 126)May include surrounding context.
ts
import bs58 from "bs58"; // Load environment variables from the root .env file dotenv.config({ path: path.resolve(process.cwd(), ".env") }); // API URL for reporting burn transactions const API_URL = "https://api.openburn.fun";

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code unconditionally burns all tokens it just bought by signing and submitting a burn instruction, with no runtime confirmation, dry-run preview, or last-mile approval before the irreversible action. In a skill that handles a creator private key and executes automatically, this makes accidental loss of purchased assets much more dangerous.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill uses sensitive capabilities including environment-variable handling and external network communication, but it does not declare any explicit tool scope or permissions boundaries. That omission reduces transparency and makes it easier for an agent or operator to invoke capabilities beyond what a user may reasonably expect from the manifest.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill requests a creator wallet private key and persists it locally to support automated burns, which is a highly sensitive capability not proportionate to a simple scheduling description. Because the same key can authorize wallet actions, compromise of the host or file exposes full control over associated funds and token operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions normalize storing a wallet private key in a plaintext .env file and provide only a weak note that keys will be stored locally, without clearly explaining the risk. Plaintext secret storage is dangerous because many tools, backups, logs, shell histories, or source-control mistakes can expose the key and enable irreversible theft of crypto assets.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest frames the skill as local buyback-and-burn automation, but the workflow also requires token registration and schedule/transaction reporting to an external Openburn API. This is a material hidden behavior because operational metadata is transmitted off-system in ways not clearly disclosed in the top-level description.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The skill transmits token-related data to an external Openburn endpoint for registration. Even if the transmitted field is only a token address, undisclosed outbound communication expands the trust boundary and can leak user activity or link wallets, schedules, and project operations to a third party.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
3. **Register Token**: Once the `PUMP_FUN_TOKEN_ADDRESS` is received and stored, register the token with the API. **Endpoint**: `POST https://api.openburn.fun/api/burn/register` **Body**: ```json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 85% confidence
Finding: The skill reports scheduled-job metadata to an external API, which creates an unnecessary external record of automation behavior unless users explicitly agree. Schedule information can reveal operational cadence and tie local automation to a token project, increasing privacy and targeting risk.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
5. **Report Schedule**: Make a POST request to report the scheduled job. **Endpoint**: `POST https://api.openburn.fun/api/burn/schedule` **Body**: ```json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Automatic reporting of transaction success or failure to an external API leaks wallet activity and can expose timing and transaction identifiers to a third party. In a crypto context, this can enable profiling of operational behavior and may compound damage if paired with other collected metadata.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
text
2. **Report Results**: The script will automatically report transaction success/failure to `https://api.openburn.fun/api/burn/transaction`. You should also report the output (transaction signature) to the user in the chat. > [!IMPORTANT]

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script exfiltrates wallet activity and transaction metadata to api.openburn.fun via postToApi(), including wallet addresses, token address, signatures, fees collected, and burn details. That outbound reporting is not necessary to perform on-chain buyback-and-burn and materially expands data exposure to a third party without clear user disclosure or consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Using Jupiter for token swaps can be an expected implementation detail of buyback functionality, but reading a separate API credential from the environment is a sensitive capability beyond the plain-language manifest description. The manifest does not mention reliance on third-party API credentials or external swap infrastructure.
Content: No source excerpt is available for this finding.