T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:61- Finding
Wallet Private Key Exposed in Plaintext Conversation Output
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentForge
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Solana integration, but it tells the agent to expose wallet private keys in chat and supports real-money mainnet actions without clear approval safeguards.
Review carefully before installing. Do not let an agent print or log wallet private keys, and do not use this for real Solana deposits, token launches, or trades unless you have an out-of-band way to secure secrets and approve every transaction with full details.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:102- Finding
Mainnet Financial Operations Lack Mandatory Transaction Confirmation and Safety Controls
- Content
View full analysis
", "symbol": "", "description": "", "imageUrl": "", "twitter": "", "telegram": "", "website": "" } ``` **Revenue:** Agents earn 65% of pump.fun creator fees, paid daily to their wallet. --- ## TRADING (Jupiter DEX) ``` POST https://youragenthome.vercel.app/api/trade Authorization: Bearer $AGENTFORGE_API_KEY { "inputMint": "", "outputMint": "", "amount": , "slippageBps": 50 } ``` ``` ### Technical Analysis The Skill supports depositing real SOL, launching tokens, and requesting token trades on Solana Mainnet through a third-party API. However, it does not require explicit per-transaction user approval, a transaction preview, simulation, recipient verification, token-mint validation, spending limits, or confirmation of the expected output. The API key appears sufficient to request authenticated launch and trade operations. If an agent derives parameters incorrectly, follows malicious task content, or operates with a compromised API key, financially consequential actions may be initiated without a clearly defined human authorization boundary. The treasury instruction also tells the operator to deposit `0.03 SOL` without specifying a trusted procedure for obtaining and independently validating the destination address. Blockchain transactions are generally ...[truncated 1692 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the agent to print one-time credentials verbatim, including a wallet private key. In an LLM/agent setting, emitting secrets into chat output, logs, traces, or shared conversation history is highly dangerous because private keys enable irreversible theft of on-chain funds and full wallet compromise.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill mandates exact reproduction of sensitive credentials in the model's response, including a private key. This is a direct unsafe-output pattern: any secret reproduced by the assistant may be captured by UI history, telemetry, or other observers, resulting in permanent compromise of the wallet and associated assets.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation requires printing one-time credentials, including a private key, without a clear safety boundary or secure handling procedure. Because model outputs are often visible to end users and retained in logs, this creates direct secret exfiltration risk and can immediately expose custody of the generated Solana wallet.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The rule 'Never truncate or summarize credentials — print them exactly as returned' overrides basic safe secret-handling practices and increases the chance of exposure. In this skill's financial/on-chain context, exact disclosure of API keys and private keys can grant transaction authority and allow immediate unauthorized actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill promotes live Solana mainnet registration, token launching, and trading without prominent warnings about irreversible transactions, volatility, scams, or fund loss. In the context of an autonomous agent skill, this is especially risky because users may trigger real financial operations without understanding the consequences or confirming intent.
- Content