Utilia Solana Preflight

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:21 AM UTC
• Version: 1.0.7

Overview

The skill is purpose-aligned but needs review because it runs downloaded wallet/payment clients, including an unpinned package and optional persistent wallet access.

Install only if you are comfortable using third-party npm clients for wallet-funded paid calls. Use a dedicated low-balance wallet, avoid `SOLANA_PRIVATE_KEY` when a narrowly scoped keypair path will work, do not send private documents or recordings, and prefer pinned or pre-reviewed package versions before using the AgentCash path or persistent MCP mode.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:17

Finding

Unpinned Third-Party Package Executes with Wallet and Payment Capabilities

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-20
Additional Relevant Locations: SKILL.md, lines 45-46, 62-98, and 109-118
Vulnerability Type: Unsafe execution of an unpinned third-party dependency
Risk Level: High

Vulnerable Code

sh

npx -y agentcash@latest balance
npx -y agentcash@latest fetch https://api.utilia.ink/v1/fees/priority --yes

The Skill also directs execution of another externally retrieved package:

sh

npx -y utilia-solana-agent@0.5.7 doctor

Persistent MCP integration similarly executes that package while granting it access to the configured wallet path:

json

{
  "mcpServers": {
    "utilia": {
      "command": "npx",
      "args": ["-y", "utilia-solana-agent@0.5.7", "mcp"],
      "env": {
        "SOLANA_KEYPAIR_PATH": "/absolute/path/to/low-balance-agent-wallet.json"
      }
    }
  }
}

Technical Analysis

The npx -y commands retrieve and execute npm package code without interactive review. The use of agentcash@latest is particularly unsafe because latest is a mutable registry tag: the effective code can change after the Skill has been reviewed without requiring any modification to this repository.

The downloaded AgentCash client creates and manages a wallet, reports its balance, negotiates a payment challenge, and automatically approves a paid request through --yes. Consequently, externally controlled package code executes in a security-sensitive context involving a potentially funded wallet.

utilia-solana-agent@0.5.7 is pinned to a version, which reduces version drift, but no package source, lockfile, or integrity hash is included in the audited project. Its implementation and handling of wallet credentials, submitted data, and network requests therefore cannot be verified from this artifact. MCP mode increases the exposure by keeping the external client available persistently with access to `SOLANA_KEYP ...[truncated 2647 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace agentcash@latest with an exact, reviewed package version. Do not use mutable npm tags for software that manages wallets or authorizes payments.
2. Commit a lockfile containing verified integrity hashes, or vendor the reviewed client implementation into a controlled distribution process.
3. Verify package provenance and signatures where supported. Pin and review all transitive dependencies, not only the top-level package version.
4. Avoid executing security-sensitive packages through ad hoc npx -y downloads. Install approved artifacts through a controlled build process and execute only the verified local artifact.
5. Run each call inside a restricted sandbox or container with:
   • A dedicated low-value wallet.
   • Only the specific wallet variable required for the operation.
   • No unrelated secrets in the inherited environment.
   • Read-only or narrowly scoped filesystem access.
   • Outbound network access restricted to explicitly approved Solana and Utilia endpoints.
   • Process, time, and resource limits.
6. Enforce payment recipient, asset, network, per-call price, and cumulative budget limits outside the downloaded client where possible. Require explicit confirmation for payments rather than relying solely on --yes.
7. Prefer one-shot execution over persistent MCP operation. If MCP access is required, isolate it in a dedicated process with a narrowly scoped wallet and terminate it when the task ends.
8. Require explicit user approval before transmitting serialized transactions or other potentially sensitive blockchain data, in addition to the existing media-consent requirement.
9. Independently audit the source of both external packages and verify that private keys are never logged, transmitted, included in error reports, or exposed to unnecessary subprocesses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs use of npx -y agentcash@latest, which pulls and executes whatever package version is current at runtime. That creates a supply-chain execution risk: a compromised publisher account, malicious update, or dependency hijack could run arbitrary code in the agent environment and potentially access wallet material, environment variables, or other local secrets.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

sh

npx -y agentcash@latest balance
npx -y agentcash@latest fetch https://api.utilia.ink/v1/fees/priority --yes

AgentCash creates and manages its own wallet on first use. The wallet must have

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This command again uses npx -y agentcash@latest, but in a context that also performs a paid network request. Because the package is unpinned and executed directly, a malicious or trojanized release could exfiltrate keys, alter payment flows, or manipulate responses before contacting the external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.