T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:7- Finding
Raw Shell Execution Exceeds the Skill's Required Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
Solpaw
Security checks for vulnerabilities and agentic risk
Overview
This skill is for real Solana token launches, but it asks for broad shell execution and wallet-key access while its implementation does not fully match its creator-control claims.
Review before installing. Use a dedicated low-balance wallet, do not expose a primary wallet private key to the agent environment, verify the exact endpoint and transaction details, and treat launches, fees, metadata uploads, and initial buys as public and irreversible. The package should ideally remove raw exec dispatch, avoid SOLANA_PRIVATE_KEY, and align its implementation with the promised local creator flow.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
solpaw-skill.ts:84- Finding
Bearer API Key Is Sent to an Unvalidated Configurable Endpoint
- Content
View full analysis
( method: string, path: string, body?: Record, headers?: Record ): Promise { const url = `${this.config.apiEndpoint}${path}`; const response = await fetch(url, { method, headers: { "Content-Type": "application/json", Authorization: `Bearer ${this.config.apiKey}`, ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(120000), // 2 min timeout for launches }); ``` ### Technical Analysis The constructor accepts any nonempty `apiEndpoint` and only removes one trailing slash. It does not enforce HTTPS, validate the hostname, reject embedded credentials, or restrict the endpoint to a trusted deployment. Every API request then attaches the configured API key in the `Authorization` header. An attacker who can influence configuration can direct authenticated requests to a server they control. A mistakenly configured plaintext HTTP endpoint would also expose the credential to network interception. In addition to the API key, launch requests transmit creator-wallet information, token metadata, a launch-fee transaction signature, and a CSRF token. Those fields are generally necessary for the ...[truncated 1320 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:10- Finding
Skill Unnecessarily Requests Full Solana Wallet Private-Key Access
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
solpaw-skill.ts:232- Finding
Documented Local-Creator Launch Flow Does Not Match the Implemented Fallback Endpoint
- Content
View full analysis
("POST", "/tokens/launch", { name: params.name, symbol: params.symbol.toUpperCase(), description: params.description, image_url: params.image_url, creator_wallet: params.creator_wallet || this.config.defaultCreatorWallet, twitter: params.twitter, telegram: params.telegram, website: params.website, initial_buy_sol: params.initial_buy_sol || 0, slippage: params.slippage || 10, priority_fee: params.priority_fee || 0.0005, launch_fee_signature: params.launch_fee_signature, csrf_token: csrfToken, }); ``` The API documentation describes this endpoint differently from the claimed local-creator flow: ```markdown ### POST /tokens/launch (Auth required) — Fallback Lightning mode: server signs the transaction. Platform wallet is the onchain creator (not recommended). Same body as `/tokens/launch-local` but without `signer_public_key`. ``` However, `SKILL.md` claims that the user wallet is the creator and shows a method that does not exist in `solpaw-skill.ts`: ```typescript const keypair = Keypair.fromSecretKey(bs58.decode(process.env.SOLANA_PRIVATE_KEY)); // One-call launch: pays fee + uploads + signs + submits const result = await solpaw.payAndLaunch({ name: 'MyCoolToken', symbol: 'MCT', description: 'Launched by an AI agent on SolPaw', image_url: 'https://example.com/logo.png', initial_buy_sol: 0.5, }, keypair); ``` The constrai ...[truncated 1876 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
bash git clone https://github.com/LvcidPsyche/solpaw.git cd solpaw cp .env.example .env # Edit .env with your values docker compose up -d
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
git clone https://github.com/LvcidPsyche/solpaw.git cd solpaw cp .env.example .env
Edit .env with your values
docker compose up -d
text
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes autonomous token launches and fee-bearing on-chain actions without a prominent warning that use will spend SOL and trigger irreversible blockchain transactions. In an agent-skill context, this increases the risk that operators enable or invoke the skill without understanding that launches and related buys cannot be rolled back once submitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The quick start instructs users to register an agent and submit token-launch data to SolPaw and downstream services, but it does not clearly disclose what metadata is shared with third parties or that uploaded token metadata may become public and effectively permanent. This can lead to unintended disclosure of wallet identifiers, agent identifiers, and project metadata in an autonomous execution setting.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
3. Register Your Agent
bash curl -X POST https://api.solpaw.fun/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{ "agent_name": "MyCoolAgent",
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill exposes sensitive capabilities via
command-tool: execand explicitly requires environment secrets and network access, but it declares nopermissionsorallowed-toolsscope. This weakens sandboxing and review controls, making it easier for the skill to access secrets and perform networked actions beyond what a caller may expect.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This step transmits data to an external service during agent registration, including wallet-related information, without any trust boundary enforcement in the skill metadata. External transmission is expected for this skill, but it is still security-relevant because it sends operator-linked data to a third-party API and relies on that service for subsequent privileged actions.
- Content
Step 1: Register (one-time)
bash curl -s -X POST https://api.solpaw.fun/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"agent_name":"MyAgent","default_fee_wallet":"YOUR_WALLET_ADDRESS"}' | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
This step transmits data to an external service during agent registration, including wallet-related information, without any trust boundary enforcement in the skill metadata. External transmission is expected for this skill, but it is still security-relevant because it sends operator-linked data to a third-party API and relies on that service for subsequent privileged actions.
- Content
Step 1: Register (one-time)
bash curl -s -X POST https://api.solpaw.fun/api/v1/agents/register \ -H "Content-Type: application/json" \ -d '{"agent_name":"MyAgent","default_fee_wallet":"YOUR_WALLET_ADDRESS"}' | jq .
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
Fetching a CSRF token from the third-party API transmits the bearer API key and establishes a privileged session with an external service. In isolation this is expected behavior, but in a skill with raw exec and env-secret access it increases exposure if logs, subprocesses, or downstream commands leak authorization material.
- Content
bash CSRF=$(curl -s -H "Authorization: Bearer $SOLPAW_API_KEY" \ https://api.solpaw.fun/api/v1/agents/csrf | jq -r '.data.csrf_token')Step 3: Send 0.1 SOL launch fee
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Uploading an image to an external API is an expected feature, but it still constitutes unscoped external data exfiltration from the agent environment. If local files are selected improperly or path inputs are influenced, the skill could transmit unintended local content to the third-party service.
- Content
Step 4: Upload token image (optional but recommended)
bash IMAGE_ID=$(curl -s -X POST https://api.solpaw.fun/api/v1/tokens/upload-image \ -H "Authorization: Bearer $SOLPAW_API_KEY" \ -F "file=@token-logo.png" | jq -r '.data.image_id')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The launch request sends token metadata, creator wallet, fee transaction reference, and CSRF token to an external API that constructs a transaction to be signed. In this context, the danger is not mere transmission but that the skill asks the agent to trust remote transaction-building logic, which could produce a transaction with unintended asset movement if not independently decoded and verified before signing.
- Content
bash # Build unsigned transaction TX_DATA=$(curl -s -X POST https://api.solpaw.fun/api/v1/tokens/launch-local \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $SOLPAW_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
The launch request sends token metadata, creator wallet, fee transaction reference, and CSRF token to an external API that constructs a transaction to be signed. In this context, the danger is not mere transmission but that the skill asks the agent to trust remote transaction-building logic, which could produce a transaction with unintended asset movement if not independently decoded and verified before signing.
- Content
bash # Build unsigned transaction TX_DATA=$(curl -s -X POST https://api.solpaw.fun/api/v1/tokens/launch-local \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $SOLPAW_API_KEY" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
Submitting a signed transaction to an external API is inherently sensitive because it finalizes blockchain actions that may spend funds irreversibly. Combined with the skill's use of a private signing key and a remotely constructed transaction flow, compromise or misbehavior by the service could result in unauthorized transfers, token launches, or loss of fees.
- Content
md # Sign the transaction with your private key, then submit SIGNED_TX="..." # sign the base64 transaction from TX_DATA curl -s -X POST https://api.solpaw.fun/api/v1/tokens/submit \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $SOLPAW_API_KEY" \ -d '{"signed_transaction": "'$SIGNED_TX'", "mint": "MINT_FROM_TX_DATA"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The SDK example normalizes a one-call flow that uses
SOLANA_PRIVATE_KEYtogether with a remote API to pay fees, upload assets, build, sign, and submit transactions. This reduces visibility into intermediate checks and encourages high-trust handling of a hot private key in an agent context, increasing the chance of secret compromise or unauthorized signing.- Content
md import { Keypair } from '@solana/web3.js'; const solpaw = new SolPawSkill({ apiEndpoint: 'https://api.solpaw.fun/api/v1', apiKey: process.env.SOLPAW_API_KEY, defaultCreatorWallet: process.env.SOLPAW_CREATOR_WALLET, });
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
yaml # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
ts # SolPaw API Reference Base URL: `https://api.solpaw.fun/api/v1` ## Authentication
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This manifest describes what the skill does, but it does not define any explicit trigger phrases, activation boundaries, or exclusion conditions. For a manifest file, that can make invocation overly broad or ambiguous because there is no clear guidance on when the skill should activate versus when similar user requests should be ignored.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The manifest configures an external API endpoint while also requiring highly sensitive secrets including a Solana private key and API key. In the context of a token-launch skill tied to on-chain wallet authority, any downstream implementation that transmits or uses these values against the remote service can enable wallet compromise, unauthorized transactions, or exfiltration of credentials, and the manifest provides no constraints on key handling or trust boundaries.
- Content
json "SOLPAW_API_KEY": "", "SOLPAW_CREATOR_WALLET": "", "SOLANA_PRIVATE_KEY": "", "SOLPAW_API_URL": "https://api.solpaw.fun/api/v1" }, "dependencies": ["curl"], "install": {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The launchToken flow is explicitly documented to require sending 0.1 SOL before launch, and the example usage shows an actual transfer followed by token launch. While comments describe the fee, the executable path in this skill performs a state-changing token launch tied to a paid transaction without any runtime confirmation prompt or user-facing warning at the point of use.
- Content
Static analysis
No suspicious patterns detected.