Security audit

sol-bsc-dev-monitor-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed wallet monitor, but it needs Review because it ships a reusable billing API key and client-side charging logic for a payment service.

Install only after reviewing the billing design. The monitoring behavior does not require private keys or sign blockchain transactions, but the published payment credential should be rotated and moved server-side, billing should require explicit user consent, and logs/detections should be treated as sensitive operational data rather than freely shared debug output.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: billing-final.js:7
Finding: Hard-Coded Billing API Credential Exposes the Skill's Billing Identity
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: billing.js:23
Finding: Broken Billing Module Exports an Undefined Function and Silently Overrides chargeUser
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index-sol-safe.js:69
Finding: Solana Monitor Attempts an Unbounded Historical Scan from Genesis
Content: View full analysis
lastSlot) { for (let i = lastSlot + 1; i <= currentSlot; i++) { const block = await connection.getBlock(i); if (block && block.transactions && block.transactions.length > 0) { for (const tx of block.transactions) { const detected = await checkTransaction(tx, address, connection); ``` After the loop, the counter is also calculated after overwriting its reference value: ```javascript lastSlot = currentSlot; slotsScanned += currentSlot - lastSlot; ``` ### Technical Analysis `lastSlot` is initialized to zero instead of the current Solana slot or a bounded historical checkpoint. On the first monitoring iteration, the code loops from slot 1 through the current network slot and makes an RPC block request for every iteration. This is far beyond the minimum privileges and resources required for the declared real-time monitoring feature. It can consume substantial network bandwidth, runtime, memory, RPC quota, and remote-provider capacity. Because each request is awaited serially, the process may never reach current activity during a normal monitoring session. The code also sets `lastSlot = currentSlot` before updating `slotsScanned`, making the reported increment zero. This conceals the actual amount of attempted work from the output. ### Attack Path 1. A user or external caller starts Solana monitoring. 2. The monitor initializes `lastSlot` to `0`. 3. It queries the current slot, which is substantially greater than zero. 4. It b ...[truncated 1035 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: index-sol-safe.js:176
Finding: Solana Token Metadata Lookup References an Out-of-Scope Connection
Content: View full analysis
0) { // New token received by target address log(`💰 New token detected!`); const tokenInfo = await getTokenInfo(tokenAmount.mint); return { signature: tx.transaction.signature, from: targetAddress, to: account.address, tokenMint: tokenAmount.mint, tokenSymbol: tokenInfo.symbol, amount: tokenAmount.uiTokenAmount.amount, decimals: tokenAmount.uiTokenAmount.decimals || 9 }; } ``` The called function references `connection`, but no variable with that name exists in its lexical or module scope: ```javascript async function getTokenInfo(mintAddress) { try { const accountInfo = await connection.getAccountInfo(mintAddress); if (accountInfo && accountInfo.data) { const data = accountInfo.data; ``` The exception is caught and replaced with fallback values: ```javascript } catch (error) { log(`❌ Error getting token info: ${error.message}`); } return { name: 'Unknown', symbol: 'UNKNOWN', decimals: 9 }; ``` ### Technical Analysis The valid Solana connection is local to `monitorSOL` and is passed into `checkTransaction`, but it is not passed onward to `getTokenInfo`. Therefore, `getTokenInfo` raises a `ReferenceError` whenever it attempts to access `connection`. The broad catch block suppresses the failure and always returns fallback metadata. As a result, apparent successful detections can contain misleading token symbols and decimal values. Incorrect decimal metadata is particularly relevant to financial research because it may materially distort displayed token quantities. ### A ...[truncated 984 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (33)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims a unified monitor role, but the documented behavior includes undeclared persistent local logging and detections storage. Undisclosed data storage increases privacy and integrity risk because monitored addresses, counterparties, and activity history may be retained on disk without permission or user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims a unified monitor role, but the documented behavior includes undeclared persistent local logging and detections storage. Undisclosed data storage increases privacy and integrity risk because monitored addresses, counterparties, and activity history may be retained on disk without permission or user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims a unified monitor role, but the documented behavior includes undeclared persistent local logging and detections storage. Undisclosed data storage increases privacy and integrity risk because monitored addresses, counterparties, and activity history may be retained on disk without permission or user awareness.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims a unified monitor role, but the documented behavior includes undeclared persistent local logging and detections storage. Undisclosed data storage increases privacy and integrity risk because monitored addresses, counterparties, and activity history may be retained on disk without permission or user awareness.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file embeds a full billing and charging workflow, including a hardcoded API key and functions to charge users and generate payment links, which materially exceeds the declared purpose of a 'wallet monitor' with 'manual buy only, no private keys'. This capability mismatch is dangerous because it can enable undisclosed monetization or unauthorized charging behavior under a misleading skill description, increasing phishing and fraud risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code has direct capability to charge users and create payment links even though those operations are unrelated to a monitoring-only wallet tool. In this context, unjustified payment functionality is dangerous because it broadens the attack surface from passive monitoring to active monetization, making deceptive billing or coercive paywalling possible.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file implements active billing and charging behavior even though the skill is described as a monitor-only wallet tool. This mismatch is dangerous because users and reviewers may trust the declared scope while the code silently performs billable external actions, creating unauthorized charges and undermining informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README says detections and logs are persisted, but it does not clearly warn that monitored wallet addresses, transaction hashes, and timing/activity data may be written to local files. On shared systems or poorly secured environments, this can leak sensitive operational intelligence about which wallets are being tracked and when noteworthy activity occurred.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README presents the skill as a monitor-only blockchain tool with no wallet interactions, but later documents a billing/payment interface that is unrelated to passive monitoring. This mismatch increases the risk of deceptive scope expansion: users may run or integrate payment-related commands under the assumption the project is strictly observational, which can expose funds, credentials, or billing identifiers unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This is a real privacy and operational-security issue. The document repeatedly says logs can be safely shared, but the examples and described contents include wallet addresses, token addresses, transaction signatures/hashes, and timestamps, which are sensitive metadata that can deanonymize users, reveal trading behavior, or expose monitored targets even if they are public on-chain.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill declares no explicit tool scope or permissions despite documenting capabilities that require network access and likely local file writes. This weakens sandboxing and informed consent because the platform and user cannot clearly constrain what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README presents a user-facing error message in Chinese only ("余额不足。最低充值...") within an otherwise English document. This imposes a language/locale on users without opt-in or an explicit statement that the skill is intended only for Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The billing flow section uses Chinese-only labels and outcomes (for example, 用户请求监控, 是, No), and the SDK section continues this pattern. Because the skill does not state a Chinese-only locale or offer language choice, this is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation says no wallet information is collected, yet the examples and storage paths show monitored addresses and transfer counterparties are recorded and persisted. This is a privacy and transparency issue because blockchain addresses are still user- or entity-linked data in context and may reveal trading or monitoring interests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill states there are no wallet interactions, but it also documents automatic withdrawal to a user's wallet and integration with a payment platform. Misrepresenting financial interactions can mislead users about where funds-related operations occur and hide financially sensitive side effects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code transmits user identifiers to an external billing service for charging and payment-link creation without any evidence of disclosure, consent, or minimization. In a wallet-monitoring skill, undisclosed third-party sharing is more concerning because users may not expect their identifiers to be sent to a billing provider at all.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Core skill execution is placed behind a billing gate, as indicated by the 'Execute your skill' comment after a successful charge. This is risky because it contradicts the manifest framing and can mislead users into invoking a monitoring tool that silently attempts payment before performing its primary function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code integrates an external billing API and embeds a live-looking API key in a wallet monitoring skill where such access is not justified by the advertised functionality. This expands the trust boundary, allows undisclosed transmission of user billing identifiers, and creates risk of abuse if the credential is extracted or reused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file hardcodes an API key and uses it for external billing calls without any disclosure or secure secret handling. Exposed credentials can be harvested from source, logs, or package distributions and then abused to make fraudulent billing requests or access the billing backend.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: A comment labels the routine as a balance check, but the function actually submits a charge request to the billing API. Misleading naming and comments can conceal monetization side effects from maintainers, auditors, or users, increasing the chance of accidental deployment of unauthorized charging behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The billing requests send user identifiers, skill identifiers, and payment-related values to a third-party service without any visible user disclosure or consent mechanism in this file. In a monitor-only skill context, this is more suspicious because users would not reasonably expect their identifiers to be transmitted for billing operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill persists monitoring activity to local log and detection files, which creates a privacy and data-retention risk for wallet addresses and transaction history. In a wallet-monitoring context, users may reasonably expect transient observation rather than durable local storage, so undisclosed persistence can expose sensitive activity to other local users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code writes wallet-related monitoring activity to local files without clear disclosure or consent, which creates a privacy risk. Because blockchain addresses can often be linked to individuals or trading behavior, retaining this data locally can leak sensitive financial patterns through file access, backups, or incident response artifacts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Using a third-party RPC endpoint for wallet monitoring exposes user interest and transaction correlation to an external service without explicit warning. Even if the address is not sent as a direct RPC parameter in every call, the monitored context and follow-on contract lookups can still reveal sensitive usage patterns and create a privacy dependency on the endpoint operator.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest describes a read-only wallet monitor with manual buy only, yet the module imports Keypair, SystemProgram, Transaction, and sendAndConfirmTransaction, which are capabilities for constructing and submitting Solana transactions. Even though they are not used in this file, their presence is inconsistent with the stated monitor-only scope and no-private-keys positioning.
Content: No source excerpt is available for this finding.