Pyre World

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:15 AM UTC
• Version: 10.2.0

Overview

This Solana game-finance skill is mostly upfront about real on-chain actions, but it needs review because its dependency/install path is inconsistent with its auditability claims and it fetches creator-controlled metadata URLs without tight network controls.

Review before installing. Prefer read-only mode first, pin and verify exact dependencies, and do not rely on the bundled-audit claim until the Kit imports the bundled SDK by explicit relative path. Never provide a funded wallet or vault authority private key; use only a fresh disposable controller with gas funds. Require human review of decoded transactions, especially withdrawals, authority transfers, borrowing, liquidation, and trades, and run it in an environment where arbitrary metadata URL fetches cannot reach private services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: lib/torchsdk/tokens.js:280

Finding

Creator-Controlled Token Metadata URL Enables Server-Side Request Forgery

Content

View full analysis

{ const controller = new AbortController(); const timer = setTimeout(() => controller.abort(), timeoutMs); const opts = { ...options, signal: controller.signal }; try { if ((0, exports.isIrysUrl)(url)) { return await fetch((0, exports.irysToArweave)(url), opts); } return await fetch(url, opts); } finally { clearTimeout(timer); } }; ``` ### Technical Analysis The `BondingCurve.uri` value is obtained from on-chain token data and can be selected by the token creator. Calling `getToken()` or the Kit's `getFaction()` wrapper causes the runtime to issue a network request to that URI. `fetchWithFallback()` applies a ten-second timeout and rewrites known Irys hostnames, but it does not: - Restrict requests to HTTPS. - Allowlist trusted metadata gateways. - Reject loopback, private, link-local, multicas ...[truncated 1918 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: lib/kit/providers/action.provider.js:4

Finding

Bundled Kit Resolves an External Torch SDK Instead of the Audited Bundled Implementation

Content

View full analysis

__importStar(require('@solana/spl-token'))); const torchsdkImport = Promise.resolve().then(() => __importStar(require('torchsdk'))); ``` `lib/kit/vanity.js:17,26`: ```js const torchsdk_1 = require("torchsdk"); ``` ```js const torch_market_json_1 = __importDefault(require("torchsdk/dist/torch_market.json")); ``` `lib/kit/util.js:16`: ```js const program_1 = require("torchsdk/dist/program"); ``` The documentation states that the SDK is bundled and that no installation is needed: ```md The Pyre Kit is bundled in lib/kit/ and the Torch SDK in lib/torchsdk/ -- all source is included for full auditability. No npm install needed. ``` ### Technical Analysis The artifact includes an implementation under `lib/torchsdk/`, but the executable Kit does not import that directory through relative paths. Bare imports such as `require("torchsdk")` are resolved through the Node.js module-resolution algorithm, normally from an installed `node_modules` package or another configured module search path. As a result, the financial transaction builders used at runtime may not be the bundled implementation reviewed in this audit. Runtime behavior depends on whichever package the host resolves under the `torchsdk` name. This is particularly security-sensitive because the imported package constructs transactions for buying, selling, borrowing, repayment, ...[truncated 2104 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (62)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill appears to query holder data, wallet ownership, transaction memos, vault/link state, token metadata, and even external pricing sources, which is broader than the top-level framing suggests. This matters because such aggregation increases privacy exposure and reliance on untrusted off-chain inputs, while operators may only expect simple game actions over on-chain primitives.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document says transactions are returned unsigned, but later documents helpers that sign or submit transactions such as high-level buy flows and wallet adapter send methods. Misstating whether the SDK submits transactions is dangerous because agents may treat it as passive tooling when it can actually trigger on-chain actions and asset movement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document says transactions are returned unsigned, but later documents helpers that sign or submit transactions such as high-level buy flows and wallet adapter send methods. Misstating whether the SDK submits transactions is dangerous because agents may treat it as passive tooling when it can actually trigger on-chain actions and asset movement.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · audit_sdk.md (reported line 376)May include surrounding context.

md

**Severity:** Low
**File:** `transactions.ts`
**Description:** Slippage values outside the 0.1%-10% range were silently clamped. A caller passing `slippage_bps: 5000` (50%) got 10% without any warning.
**Impact:** Unexpected slippage behavior. Not a fund safety issue — trades fail rather than execute at bad prices.
**Resolution:** Out-of-range `slippage_bps` values now throw an explicit error with the accepted range (10–1000 bps).

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The liquidation instruction is documented as permissionless but does not clearly warn that it can seize collateral from another user's loan position. In an autonomous-agent setting, this omission is dangerous because agents may treat liquidation as a routine maintenance action rather than an adversarial enforcement action affecting third-party assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The short liquidation manifest text omits a plain warning that the action forcibly closes another user's short and seizes their posted collateral. In this agent-oriented skill, insufficient disclosure raises the chance of accidental or abusive invocation by automation that does not surface the third-party harm or finality of the action.

Content

No source excerpt is available for this finding.

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 85% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · lib/torchsdk/transactions.js (reported line 1415)May include surrounding context.

js

})))
            .instruction();
    };
    // Helper: build the swap instruction
    const buildSwapIx = async () => {
        return program.methods
            .swapFeesToSol(new anchor_1.BN(minimum_amount_out.toString()))

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares environment and network capabilities but does not explicitly scope or constrain tool permissions. In an agent setting that can read secrets and make outbound RPC/HTTP requests, missing permission boundaries increases the chance of unintended secret access or unauthorized network use, especially because the skill also discusses optional private-key handling and external services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest presents a very broad set of agent capabilities, including trading, lending, liquidation, authority transfer, and custody operations, but does not define explicit trigger scope, approval gates, or invocation constraints in the manifest itself. In an agentic environment, this increases the risk of unsafe or unintended execution because high-impact actions may be reachable without sufficiently clear policy boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The action list includes many high-impact and irreversible operations such as withdrawals, authority transfer, recruitment/exile, liquidation, direct trading, and faction launch, but the top-level description does not prominently warn users about financial risk, irreversible state changes, or required privilege levels. In this context, understated risk communication is dangerous because the skill is designed for on-chain mainnet use and can affect assets, permissions, and identity-linked state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents that transfer_authority is irreversible, requires no acceptance from the new authority, and can permanently lock the profile if sent to an invalid pubkey. Under the markdown-specific missing-warning rule, this behavior affects user control and system integrity, but the description does not include a clear warning or user-facing caution despite acknowledging the risk.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

A unilateral, irreversible authority transfer with no acceptance or handshake step can permanently lock the profile if the destination pubkey is mistyped, inaccessible, or not controlled by the intended recipient. In this skill context, authority governs future link/unlink/transfer operations, so a single mistaken action can cause durable loss of administrative control even if no funds move directly.

Content

Scanner excerpt · audit_program_pyre.md (reported line 144)May include surrounding context.

md

**Analysis:**
- Only the current authority can transfer. Anchor `relations` constraint enforces this.
- The `creator` field is immutable (PDA seed). Only `authority` changes.
- No confirmation from `new_authority` — this is a unilateral transfer. The current authority must trust the destination.
- After transfer, the old authority loses all control (link/unlink/transfer). This is equivalent to the "coup" mechanic in the game layer.

**Findings:**

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file content is materially inconsistent with the declared skill purpose: a pyre-world faction/identity wrapper is instead shipping a long Torch Market audit and trading-system narrative. This kind of scope mismatch is dangerous because it can mislead reviewers and agents about what the skill actually does, hide undeclared financial capabilities, and weaken trust boundaries during autonomous use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The agent-facing section encourages setting up vaults, depositing SOL, buying tokens, and confirming trades without an explicit, prominent warning that these are real value-moving financial actions with loss risk. In an agent skill context, omission of such warnings is more dangerous because autonomous or semi-autonomous agents may execute actions from terse instructions without the user appreciating custody, spending, market, or liquidation risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.