THE FLIP

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:47 AM UTC
• Version: 1.0.8

Overview

This appears to be a real Solana devnet game skill, but it needs Review because it can use a local wallet key and includes operator fund and game-closure actions that are not clearly separated from normal gameplay.

Use this only with a fresh devnet-only Solana wallet, never with a wallet that holds real funds or controls production programs. Review the demo commands before running them, especially fee withdrawal and game closure paths, and prefer safer manual installation or pinned dependencies over blindly running remote install scripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence
• Finding: The skill exposes network behavior through its API endpoints and remote setup flow, but does not declare corresponding permissions in its metadata. Undeclared network capability reduces transparency for users and agents, making it easier to conceal external communication or data exfiltration paths behind an apparently low-privilege skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill description presents the game as trust-minimized and focused on jackpot participation, but the analyzed behavior indicates an authority can withdraw operator fees and close old game accounts to reclaim lamports. That mismatch is security-relevant because users may infer there are no privileged fund flows or admin controls when, in fact, administrative financial actions exist.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill description presents this as a simple player-facing prediction game, but the script exposes operator and lifecycle actions such as fee withdrawal and game closure. This mismatch is dangerous because users or integrating agents may grant wallet access under the assumption of limited gameplay functionality, while the code can perform privileged administrative operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script loads a private key from a local file or ANCHOR_WALLET environment variable, which gives it signing authority well beyond the narrowly described gameplay behavior. In an agent-skill context, undisclosed secret-loading is risky because it conditions users to run code that can access sensitive wallet material and sign unintended transactions.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script includes an operator fee-withdrawal path that transfers funds from the program vault to the authority token account, but this privileged capability is not reflected in the user-facing skill description. In a wallet-connected agent setting, hidden fund-movement functionality is especially dangerous because users may invoke or approve the skill expecting game entry only, while the code can initiate administrative withdrawals.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The game-closure/migration command can perform lifecycle-destructive actions unrelated to normal gameplay, yet the manifest describes only player prediction and jackpot behavior. This is dangerous because closing or migrating on-chain state can disrupt availability, destroy expected state, or enable misuse if an agent or operator executes it without clearly understanding its privileged nature.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill description presents only the player-facing gameplay, while the IDL exposes privileged administrative operations such as initialize_game, close_game_v1, and withdraw_fees. This mismatch can mislead users and integrators about the trust model and operator powers, which is dangerous in a custodial jackpot game because the authority can control setup, migration, and fee extraction.

Description-Behavior Mismatch

Low

• Confidence: 89% confidence
• Finding: The skill description presents only the player-facing gameplay, while the IDL exposes privileged administrative operations such as initialize_game, close_game_v1, and withdraw_fees. This mismatch can mislead users and integrators about the trust model and operator powers, which is dangerous in a custodial jackpot game because the authority can control setup, migration, and fee extraction.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The program includes an authority-controlled close path that can zero and drain the game state PDA even though the advertised behavior is a live jackpot game. In a pooled-funds gambling context, this is dangerous because the operator can abruptly disable the game, strand tickets, and undermine player assumptions about availability and claimability, especially since no migration safeguards, pause flow, or player settlement procedure are enforced here.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This account-closing capability is broader than the stated game purpose and gives the authority unilateral power over core game availability. Even though it only directly moves lamports from the game account rather than SPL tokens from the vault, it can still break the protocol by destroying state needed for future rounds and claims, which is particularly risky in a jackpot game where users rely on persistent state correctness.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: The comment says a player enters for the next round, but the code stores `ticket.round = game.current_round`, meaning the ticket is for the current unflipped round. In this game design, misleading round semantics can cause user misunderstanding about when predictions apply and can lead integrators or frontends to present incorrect odds/timing, creating fairness and trust issues around entry windows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to post their wallet address publicly to receive devnet USDC but does not warn about the privacy, targeting, and impersonation risks of linking a wallet to a public identity or thread. In a crypto context, even a public address can be used for profiling, scam targeting, phishing, and social engineering, so the omission is a genuine safety issue in user guidance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup instructions tell users to execute a remote shell script directly via curl piped into sh, which is a classic supply-chain risk. If the remote host, distribution path, or connection is compromised, users could run arbitrary code on their machine without reviewing it first.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"demo": "node app/demo.mjs"
  },
  "dependencies": {
    "@coral-xyz/anchor": "^0.30.1",
    "@solana/spl-token": "^0.4.14",
    "@solana/web3.js": "^1.98.4"
  },

• Confidence: 90% confidence
• Finding: The production dependency uses a caret range, which allows npm to install newer minor/patch releases than the version reviewed by the author. If an upstream package is compromised or introduces a breaking security change, builds may silently consume it and affect Solana transaction handling or wallet-related logic.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@coral-xyz/anchor": "^0.30.1",
    "@solana/spl-token": "^0.4.14",
    "@solana/web3.js": "^1.98.4"
  },
  "devDependencies": {

• Confidence: 90% confidence
• Finding: This package is referenced with a non-exact version, so future installs may resolve to a different release than the one originally tested. In a blockchain skill that handles token interactions, unexpected upstream changes can create supply-chain risk or alter token-related behavior without code changes in this repository.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@coral-xyz/anchor": "^0.30.1",
    "@solana/spl-token": "^0.4.14",
    "@solana/web3.js": "^1.98.4"
  },
  "devDependencies": {
    "@types/chai": "^4.3.0",

• Confidence: 92% confidence
• Finding: Using a caret range for @solana/web3.js permits automatic adoption of newer compatible releases, increasing exposure to malicious or vulnerable upstream publishes. Because this skill interacts with Solana infrastructure, dependency drift in a core blockchain client library is somewhat more sensitive than in a generic application.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@solana/web3.js": "^1.98.4"
  },
  "devDependencies": {
    "@types/chai": "^4.3.0",
    "@types/mocha": "^10.0.0",
    "chai": "^4.3.0",
    "ts-mocha": "^10.0.0",

• Confidence: 80% confidence
• Finding: The dev dependency is unpinned, which can make test and build environments non-reproducible and expose developers or CI systems to compromised upstream releases. Although this is less severe than a runtime dependency, supply-chain attacks often target developer tooling first.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/chai": "^4.3.0",
    "@types/mocha": "^10.0.0",
    "chai": "^4.3.0",
    "ts-mocha": "^10.0.0",
    "typescript": "^5.0.0"

• Confidence: 80% confidence
• Finding: A version range on this developer package allows silent dependency drift across local and CI environments. That can introduce malicious or vulnerable code into the build/test pipeline even if the application source remains unchanged.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"devDependencies": {
    "@types/chai": "^4.3.0",
    "@types/mocha": "^10.0.0",
    "chai": "^4.3.0",
    "ts-mocha": "^10.0.0",
    "typescript": "^5.0.0"
  }

• Confidence: 80% confidence
• Finding: The chai dependency is not pinned exactly, so different installs may receive different package contents over time. While primarily used in testing, compromised test dependencies can still affect CI runners, secrets exposure, or release integrity.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@types/chai": "^4.3.0",
    "@types/mocha": "^10.0.0",
    "chai": "^4.3.0",
    "ts-mocha": "^10.0.0",
    "typescript": "^5.0.0"
  }
}

• Confidence: 80% confidence
• Finding: This unpinned test runner dependency introduces supply-chain and reproducibility risk in development workflows. If a malicious or vulnerable release is published upstream, it could execute in CI or developer environments during testing.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@types/mocha": "^10.0.0",
    "chai": "^4.3.0",
    "ts-mocha": "^10.0.0",
    "typescript": "^5.0.0"
  }
}

• Confidence: 82% confidence
• Finding: An unpinned TypeScript compiler version means builds may change over time without repository changes, which weakens reproducibility and may pull in compromised upstream code. Toolchain integrity matters because compiler or transpiler changes can influence generated artifacts and CI trustworthiness.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: app/demo.mjs:44

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: app/demo.mjs:44