Solpaw Interaction Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:12 PM UTC
• Version: 0.1.1

Overview

This skill is for a real Solana token-launch service, but it asks for wallet-level secrets and broad command execution in a way that needs careful review before installation.

Install only after reviewing the wallet and endpoint risks. Use a dedicated low-balance wallet, avoid exposing a main wallet private key as an environment variable, keep the API endpoint pinned to the intended SolPaw host, and require explicit human confirmation plus transaction review before paying fees, signing, submitting, or making any initial buy.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: solpaw-skill.ts:83

Finding

API Credential Disclosure Through an Unrestricted Configurable Endpoint

Content

View full analysis

( method: string, path: string, body?: Record, headers?: Record ): Promise { const url = `${this.config.apiEndpoint}${path}`; const response = await fetch(url, { method, headers: { "Content-Type": "application/json", Authorization: `Bearer ${this.config.apiKey}`, ...headers, }, body: body ? JSON.stringify(body) : undefined, signal: AbortSignal.timeout(120000), }); ``` ### Technical Analysis The constructor accepts any nonempty `apiEndpoint` and performs no scheme, hostname, port, or origin validation. The common request function subsequently sends the configured API key in an `Authorization: Bearer` header to that endpoint on every request. As a result, configuration manipulation can redirect credentials and request data to an unrelated server. The implementation also does not require HTTPS, so a configuration using plain HTTP could expose credentials to network interception. Depending on the invoked method, transmitted information can include: - The SolPaw API key - Creator wallet addresses - Launch-fee transaction signatures - Token names, symbols, descriptions, and social links - CSRF tokens - Account-spec ...[truncated 1796 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:1

Finding

Raw Command Execution Is Combined With Access to a Wallet Private Key

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 241)May include surrounding context.

bash

git clone https://github.com/LvcidPsyche/solpaw.git
cd solpaw
cp .env.example .env
# Edit .env with your values
docker compose up -d

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 242)May include surrounding context.

git clone https://github.com/LvcidPsyche/solpaw.git cd solpaw cp .env.example .env

Edit .env with your values

docker compose up -d

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README promotes autonomous token launches and optional initial buys, both of which are irreversible on-chain financial actions, but it does not prominently warn users about fund loss, inability to reverse transactions, or the legal/financial risks of automated token issuance. In an agent skill context, this omission is dangerous because operators may enable the skill without understanding that an autonomous agent can spend SOL and create public blockchain assets with lasting consequences.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

3. Register Your Agent

bash

curl -X POST https://api.solpaw.fun/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "MyCoolAgent",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill exposes powerful capabilities via command-tool: exec, raw argument mode, environment-variable access, and outbound network use, but does not declare any explicit tool scope such as permissions or allowed-tools. In practice this weakens least-privilege controls and makes it easier for the skill to access secrets and perform sensitive external actions without clear policy boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Step 1: Register (one-time)

bash

curl -s -X POST https://api.solpaw.fun/api/v1/agents/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name":"MyAgent","default_fee_wallet":"YOUR_WALLET_ADDRESS"}' | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The launch-local request sends token metadata, wallet identifiers, a CSRF token, and a launch-fee transaction reference to an external service that returns a transaction for local signing. In this context the remote service is participating in construction of a blockchain transaction that will later be signed with the user's private key, so a compromised or malicious service could craft unexpected transaction contents and induce fund loss or unauthorized on-chain actions if the client does not independently verify the transaction before signing.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Build unsigned transaction
TX_DATA=$(curl -s -X POST https://api.solpaw.fun/api/v1/tokens/launch-local \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SOLPAW_API_KEY" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The launch-local request sends token metadata, wallet identifiers, a CSRF token, and a launch-fee transaction reference to an external service that returns a transaction for local signing. In this context the remote service is participating in construction of a blockchain transaction that will later be signed with the user's private key, so a compromised or malicious service could craft unexpected transaction contents and induce fund loss or unauthorized on-chain actions if the client does not independently verify the transaction before signing.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Build unsigned transaction
TX_DATA=$(curl -s -X POST https://api.solpaw.fun/api/v1/tokens/launch-local \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SOLPAW_API_KEY" \
  -d '{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

Submitting a locally signed transaction to the external API is inherently sensitive because the skill is orchestrating irreversible blockchain actions involving the user's wallet and funds. In combination with required access to SOLANA_PRIVATE_KEY, this creates a high-risk path where insufficient validation, weak user confirmation, or compromised upstream transaction generation could result in unauthorized token launches or financial loss.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

# Sign the transaction with your private key, then submit
SIGNED_TX="..." # sign the base64 transaction from TX_DATA
curl -s -X POST https://api.solpaw.fun/api/v1/tokens/submit \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SOLPAW_API_KEY" \
  -d '{"signed_transaction": "'$SIGNED_TX'", "mint": "MINT_FROM_TX_DATA"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The TypeScript example directly loads SOLANA_PRIVATE_KEY from environment variables and constructs a keypair in process memory for one-call fee payment, upload, signing, and submission. This concentrates secret handling and high-value financial actions in a single skill flow, increasing the blast radius if the skill, runtime, logs, or dependencies are compromised.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md

import { Keypair } from '@solana/web3.js';

const solpaw = new SolPawSkill({
  apiEndpoint: 'https://api.solpaw.fun/api/v1',
  apiKey: process.env.SOLPAW_API_KEY,
  defaultCreatorWallet: process.env.SOLPAW_CREATOR_WALLET,
});

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The description says the skill is for "launching tokens on Solana via Pump.fun" but does not define specific trigger phrases, activation scope, or exclusion conditions, making invocation criteria ambiguous rather than narrowly bounded.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 268)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-docs.md (reported line 3)May include surrounding context.

md

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · solpaw-skill.ts (reported line 314)May include surrounding context.

ts

# SolPaw API Reference

Base URL: `https://api.solpaw.fun/api/v1`

## Authentication

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation exposes a fallback mode where the server signs the launch transaction, meaning users must trust the platform with transaction construction and signing behavior. Even though it notes this mode is 'not recommended,' it does not clearly explain the custody, impersonation, creator attribution, and transaction-integrity risks, so integrators may use a materially less safe path without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The manifest defines an external API endpoint and requires highly sensitive secrets including a Solana private key, indicating the skill is designed to transmit privileged data to a remote service context. In a wallet-linked token-launching skill, this is especially dangerous because compromise, misuse, or unclear handling of the private key could lead to unauthorized transactions, wallet drain, or irreversible onchain actions.

Content

Scanner excerpt · skill.json (reported line 8)May include surrounding context.

json

"SOLPAW_API_KEY": "",
    "SOLPAW_CREATOR_WALLET": "",
    "SOLANA_PRIVATE_KEY": "",
    "SOLPAW_API_URL": "https://api.solpaw.fun/api/v1"
  },
  "dependencies": ["curl"],
  "install": {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 79% confidence

Finding

The skill is configured to send data to an external API endpoint and requires a secret API key, which creates a real data-exfiltration and trust boundary risk. In this case the transmission appears necessary for the skill's advertised functionality, but it still exposes credentials and possibly transaction metadata to a third-party service outside the agent runtime.

Content

Scanner excerpt · skill.yml (reported line 21)May include surrounding context.

yaml

- name: api_endpoint
    type: string
    required: true
    default: https://api.solpaw.fun/api/v1
    description: SolPaw API endpoint
  - name: api_key
    type: string

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest exposes a command that launches tokens on Pump.fun but provides no warning about irreversible blockchain actions, fees, or financial risk. In an agent context, users may trigger token creation without understanding that funds can be spent and on-chain actions cannot be undone, increasing the chance of harmful or unintended transactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The skill is explicitly designed to send authenticated requests to an external API using a bearer API key and to drive on-chain payments to a platform-controlled wallet. In the context of an agent skill that can trigger financial actions, this is security-relevant because a compromised, malicious, or spoofed endpoint could induce fund transfers, misuse the API key, or manipulate launch parameters/results.

Content

Scanner excerpt · solpaw-skill.ts (reported line 61)May include surrounding context.

ts

*   skills:
 *     - name: solpaw-launcher
 *       config:
 *         api_endpoint: https://api.solpaw.fun/api/v1
 *         api_key: ${SOLPAW_API_KEY}
 *         default_creator_wallet: ${CREATOR_WALLET}
 *

Static analysis

No suspicious patterns detected.