THE FLIP

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:32 AM UTC
• Version: 1.0.8

Overview

This is a coherent Solana devnet coin-flip skill, but it should go to Review because it asks users to run an unpinned remote installer and exposes a fund-moving gambling flow with under-disclosed and unsafe contract behavior.

Review before installing. Use only a throwaway devnet wallet with no real assets, avoid running the curl-to-sh installer unless you independently trust and verify it, and do not treat the jackpot game as fair or production-safe without contract fixes for randomness and round-specific payout accounting.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:106

Finding

Unpinned Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: program/src/lib.rs:106

Finding

Public and Caller-Timed Inputs Are Used as Gambling Randomness

Content

View full analysis

> bit_idx) & 1; game.round_results[base_idx + i] = if bit == 0 { 1 } else { 2 }; } game.last_flip_at = clock.unix_timestamp; game.current_round += 1; ``` ### Technical Analysis The result is a deterministic SHA-256 hash of: - The public round number - The current slot - The current on-chain timestamp - The public game PDA Hashing public values does not create secret or unbiased entropy. The round and game address are known in advance, while slot and timestamp are observable and partially timing-dependent. Because `flip` is permissionless, a participant can choose when to submit the transaction after the cooldown expires. Transaction ordering and block-production influence can provide additional opportunities to delay, include, or exclude a flip at advantageous times. The first 14 hash-derived bits determine whether a ticket wins. A participant can calculate candidate outcomes for plausible slot and timestamp combinations and selectively attempt a flip when those combinations favor the participant's known ticket. A validator or party with transaction-ordering influence has a ...[truncated 2099 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: program/src/lib.rs:137

Finding

Delayed Claims Can Capture Jackpot Deposits from Later Rounds

Content

View full analysis

ticket.round, FlipError::RoundNotFlipped ); // Must be within buffer window (last 32 rounds) require!( game.current_round - ticket.round <= ROUNDS_BUFFER as u32, FlipError::BufferExpired ); require!(!ticket.collected, FlipError::AlreadyCollected); // Verify first 14 predictions match round results let base_idx = (ticket.round as usize % ROUNDS_BUFFER) * PREDICTIONS_SIZE; for i in 0..SURVIVAL_FLIPS { require!( ticket.predictions[i] == game.round_results[base_idx + i], FlipError::NotAWinner ); } ticket.winner = true; ticket.collected = true; game.total_wins += 1; // Winner takes the entire jackpot let payout = game.jackpot_pool; // PDA signer seeds for vault let authority_key = game.authority; let seeds = &[ b"vault" as &[u8], authority_key.as_ref(), &[game.vault_bump], ]; let signer_seeds = &[&seeds[..]]; let cpi_ctx = CpiContext::new_with_signer( ctx.accounts.token_program.to_account_info(), Transfer { from: ctx.accounts.vault.to_account_info(), to: ctx.accounts.player_token_account.to_account_info(), authority: ctx.accounts.vault.to_account_info(), }, signer_seeds, ); token::transfer(cpi_ctx, payout)?; game.jackpot_pool = 0; ``` ### Technical Analysis The contract maintains one global `jackpot_pool`, but it does not snapshot or reserve the jackpot associated with each completed round. A valid ticket remains claimable until its result is overwritten after 32 rounds. During that claim window, new entries continue increasing the same global pool. When an old winner claims, the payout is not the jackpot amount that existed when the winning round was flipped. Instead, the program reads the current value of `ga ...[truncated 2098 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior does not fully match the broader capability set described by analysis: operator fee withdrawal, admin/authority controls, and local test-harness behavior are materially relevant to user trust and financial risk. When a blockchain skill omits fee extraction paths or control relationships, users may send funds under false assumptions about decentralization, custody, or where value can be diverted.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

bigint-buffer 1.1.5 is explicitly present in the lockfile and is reported with a high-severity memory safety issue in toBigIntLE(). Even though this is a transitive dependency, native install-script/native-binding packages increase supply-chain and memory-corruption risk, especially in a blockchain client stack that processes binary data.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

brace-expansion 2.0.2 is present and the cited advisories are classic expansion-based DoS issues. In this lockfile it appears in dev/test tooling paths, which lowers exploitability in production, but it still represents a real dependency risk if CI, local tooling, or any exposed build service processes attacker-controlled glob patterns.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

js-yaml 4.1.1 is present with multiple CPU-exhaustion advisories. Although it appears via mocha dev tooling and is less likely to be reachable in production, YAML parsers are commonly abused for DoS when they consume attacker-controlled input in CI, tests, or auxiliary scripts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==9.0.5 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

minimatch 9.0.5 is present and affected by multiple ReDoS/backtracking issues. In this tree it is tied to dev tooling, reducing direct runtime risk, but any service or automation that accepts attacker-controlled glob patterns could suffer significant CPU exhaustion.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

ws 8.19.0 is present through rpc-websockets and carries memory disclosure and memory exhaustion advisories. Because Solana clients rely on websocket/RPC connectivity, this is more relevant than a generic tooling issue: malformed remote websocket traffic could affect a running client that monitors chain events.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: serialize-javascript==6.0.2 — 2 advisory(ies): GHSA-5c6j-r48x-rmvq (Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.to); CVE-2026-34043 (Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

serialize-javascript 6.0.2 is present with reported RCE and CPU-exhaustion issues, but in this dependency graph it is part of mocha test tooling rather than the declared runtime blockchain dependencies. That makes runtime exploitability less likely for the shipped skill, though it remains a real supply-chain issue for developer and CI environments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: toml==3.0.0 — 2 advisory(ies): CVE-2026-77465 (toml-node: Uncontrolled Recursion); CVE-2026-63376 (toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__pro)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

toml 3.0.0 is directly present under anchor and the cited issues include uncontrolled recursion and prototype pollution. Since Anchor-based Solana projects commonly parse TOML configuration files, compromised or attacker-supplied config input could cause denial of service or object prototype corruption in supporting scripts and tooling.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

ws 7.5.10 is also present separately under jayson and carries a high-severity memory exhaustion DoS issue. Because jayson is used by @solana/web3.js for RPC interactions, a blockchain-facing client may maintain network connections that increase the practical relevance of websocket resource-exhaustion bugs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The test script invokes ts-mocha through npx without pinning an explicit version, which can cause execution of whatever package version is currently resolved from the registry. In environments without a locked local dependency or with a compromised/typosquatted package path, this creates a supply-chain risk where unexpected code may run during testing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README instructs users to run commands that submit on-chain transactions and pass a wallet keypair path, but it does not prominently warn that these actions authorize spending USDC and incur blockchain transactions. In an agent skill context, this can cause users or automation to run fund-moving commands against a real wallet without understanding the financial consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation includes an operator command for withdrawing fees from the protocol without a clear, prominent warning that the skill supports a fund-withdrawal operation. Even if intended for operators, exposing this in generic usage docs increases the risk that an agent or user invokes a money-moving function without sufficient role, environment, or authorization checks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 290)May include surrounding context.

bash

# Game state (base64 -> decode with IDL layout)
curl -s https://api.devnet.solana.com -X POST -H "Content-Type: application/json" -d '{
  "jsonrpc": "2.0", "id": 1,
  "method": "getAccountInfo",
  "params": ["AAEwxhqM1EGjTbCyPqSCX7YpyuRqzBBfyf2kJG1nsGqd", {"encoding": "base64"}]

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises and instructs networked interactions with external infrastructure (Vercel API, Solana tooling, curl-based installer) but does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can cause users or orchestrators to underestimate that the skill may access the network and trigger remote actions, increasing the chance of unintended external calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directly instructs users to run an 'enter' command that spends 1 USDC, but the transactional and irreversible nature of that action is not presented as an explicit safety warning. In wallet-connected or agent-mediated environments, users may treat the command like a harmless demo action and authorize spending without understanding the cost or settlement implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The setup section tells users to install Solana tooling, generate a wallet, and fund it, but it does not warn that this creates a private key whose loss or exposure can compromise assets. It also includes a curl-to-shell installer pattern, which compounds risk by encouraging execution of remote code alongside sensitive key setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads a private key JSON from a user-supplied path, the ANCHOR_WALLET environment variable, or the default Solana wallet location. Although this access is functionally necessary, there is no visible disclosure at the credential-loading point that the script will read sensitive wallet material from disk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The public description presents the skill as a simple coin-flip jackpot game, but the IDL exposes additional privileged capabilities such as game closure/migration and operator fee withdrawal. This mismatch can mislead integrators and users about the actual trust assumptions, causing them to interact with a program that has more centralized control than advertised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The interface includes an authority-only game closure/migration instruction that is not disclosed by the stated game purpose. Even if intended for maintenance, hidden administrative recovery or closure paths introduce custodial risk because the operator may be able to disrupt the game lifecycle or reclaim state unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The IDL exposes an authority-controlled fee withdrawal path from the vault, but the manifest does not tell users that the operator can extract funds from the same system holding game assets. In a jackpot game context, undisclosed withdrawal authority materially increases trust risk because users may assume the vault is only used for automated payouts when it also supports operator-controlled outflows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code and documentation disagree on round assignment: comments say entries are for the next round, but ticket.round = game.current_round makes them eligible for the current unflipped round. In a gambling game using predictable on-chain entropy, this mismatch can mislead users and can combine with transaction timing around flip to create fairness and trust issues about which round a ticket actually entered.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill is described as a jackpot game where players enter, flip, and win based on their own predictions, but the claim instruction does not require the signer claimer to be the ticket owner or authority. Because ticket.player is only matched against the unchecked player account and payout goes to that player's token account, any third party can execute the claim on someone else's behalf, which is a capability not justified by the stated game purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This is a JSON manifest file, so vague-trigger checks apply. The description "THE FLIP - $1 to $1M coin flip game on Solana" describes the skill broadly but does not specify any concrete trigger phrases, activation scope, or when the skill should or should not be invoked, which can make routing ambiguous in systems that use manifest descriptions for activation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bn.js==5.2.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

bn.js 5.2.2 is present and the reported issue is a low-severity infinite-loop/DoS condition. In a Solana/crypto codebase, big-number parsing may touch untrusted or malformed inputs, so a hang can still affect availability even if it does not directly compromise integrity or confidentiality.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: app/demo.mjs:44

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: app/demo.mjs:44