ClawHub
Back to skill

Security audit

Tokenized Agents

Security checks for vulnerabilities and agentic risk

Overview

The skill is payment-focused and not malicious, but it relies on mutable external instructions and loosely constrained npm installs for wallet/payment code.

Before installing, pin every dependency version, use a reviewed lockfile, and review or vendor the linked wallet/scenario documentation instead of letting the agent follow mutable main-branch URLs. Keep wallet signing user-approved and never provide private keys or seed phrases.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:75
Finding

Insufficiently constrained third-party payment dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:75
Vulnerability Type: Supply-chain exposure through dependencies with install-time execution capability
Risk Level: Medium

Vulnerable Code Snippet:

bash
npm install @pump-fun/agent-payments-sdk@3.0.2 @solana/web3.js@^1.98.0

The Skill also instructs users to install additional wallet-adapter packages without specifying versions:

markdown
Install `@solana/wallet-adapter-react`, `@solana/wallet-adapter-react-ui`, and `@solana/wallet-adapter-wallets`.

Technical Analysis

The primary payment SDK is pinned to version 3.0.2, but @solana/web3.js is specified using a semver range, and the wallet-adapter dependencies are not pinned at all. The instructions do not require a reviewed lockfile, package integrity verification, lifecycle-script review, or an initial installation with scripts disabled.

npm packages and their transitive dependencies can run lifecycle scripts during installation under the privileges of the user running npm. Consequently, later releases selected by the version range, compromised upstream releases, or malicious transitive dependencies could execute code that was not present during this audit.

No evidence establishes that the named packages are currently malicious. The vulnerability is the Skill's unsafe dependency acquisition and verification process, which leaves the effective installed code outside the reviewed package and insufficiently constrained.

Attack Path

  1. An upstream package account, release pipeline, or transitive dependency is compromised.
  2. A malicious package version is published within an allowed version range, or an unpinned wallet-adapter package resolves to the compromised release.
  3. A user or Agent follows the Skill's installation instructions.
  4. npm downloads the unreviewed version and may execute its lifecycle scripts.
  5. Malicious code executes with the npm process's user privile ...[truncated 677 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version, including all wallet-adapter packages.
  2. Commit a reviewed lockfile and require reproducible installation through npm ci rather than unconstrained npm install.
  3. Verify package provenance and lockfile integrity before installation.
  4. Review package manifests and transitive dependencies for lifecycle scripts.
  5. Perform an initial dependency inspection with npm install --ignore-scripts where compatible, and enable only explicitly required scripts after review.
  6. Run installation in a restricted development environment without production secrets or unnecessary filesystem permissions.
  7. Add automated dependency scanning and require review before lockfile updates.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:128
Finding

Mandatory agent guidance is delegated to mutable remote documents

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:128 and SKILL.md:496
Vulnerability Type: Mutable remote instructions can alter Agent-generated implementations after local review
Risk Level: Medium

Vulnerable Code Snippets:

markdown
Install `@solana/wallet-adapter-react`, `@solana/wallet-adapter-react-ui`, and `@solana/wallet-adapter-wallets`. Use `useWallet()` for `publicKey` and `signTransaction`, and `useConnection()` for the active RPC connection. MUST See [https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/WALLET_INTEGRATION.md](https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/WALLET_INTEGRATION.md) for the full WalletProvider setup, layout wrapping, and hook usage.
markdown
See [https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/SCENARIOS.md](https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/SCENARIOS.md) for detailed test scenarios (happy path, duplicate rejection, expired invoices, etc.) and a troubleshooting table for common errors and for wallet Integration must follow [https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/WALLET_INTEGRATION.md](https://raw.githubusercontent.com/pump-fun/pump-fun-skills/refs/heads/main/tokenized-agents/references/WALLET_INTEGRATION.md).

Technical Analysis

The Skill directs the Agent to consult and, for wallet integration, follow documents retrieved from the mutable main branch of an external GitHub repository. Those documents are not included in the audited artifact, and their content can change without changing the reviewed SKILL.md.

Because the remote text is framed as mandatory implementation guidance, control of the repository or its publishing account could be used to introduce new inst ...[truncated 1698 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle all required wallet-integration and scenario documentation inside the Skill package so it is covered by the same review.
  2. If external hosting is unavoidable, reference an immutable Git commit rather than refs/heads/main.
  3. Record and verify a cryptographic digest of every external reference before its content is used.
  4. Treat remotely retrieved text as untrusted reference material rather than mandatory Agent instructions.
  5. Explicitly prohibit external documents from overriding the Skill's safety rules or requesting secrets, private keys, additional tool permissions, or unrelated network operations.
  6. Require security review whenever the pinned remote document or its expected digest changes.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md
### Parameters (`BuildAcceptPaymentParams`)

| Parameter          | Type                         | Description                                                                                          |
| ------------------ | ---------------------------- | ---------------------------------------------------------------------------------------------------- |
| `user`             | `PublicKey`                  | The payer's wallet address                                                                           |
| `currencyMint`     | `PublicKey`                  | Mint address of the payment currency (USDC, wSOL)                                                    |