Security audit

pumpmarket skill

Security checks across malware telemetry and agentic risk

Overview

This is an openly disclosed real-SOL betting skill, but it gives an agent direct mainnet wallet-signing ability without strong built-in spending controls.

Install only if you intentionally want an agent to trade real SOL on PumpMarket. Use a dedicated low-balance wallet, avoid exposing a main wallet private key, pin and review dependencies, simulate first, and require explicit approval plus a strict SOL cap before any transaction is signed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The IDL exposes a full custodial betting protocol with fund-holding vaults, market resolution, payout/refund claims, vault closure, and emergency withdrawal, while the skill metadata describes a token-graduation prediction skill. That mismatch can cause users, integrators, or reviewers to underestimate the transactional and custody risk, leading them to invoke high-impact on-chain actions they did not expect.

Context-Inappropriate Capability

High

Confidence: 91% confidence
Finding: The presence of an emergencyWithdraw instruction means the program includes an administrative path to move user funds from the vault after a delay, which is materially broader than a simple prediction skill. Even if intended for fund recovery, such privileged withdrawal paths create centralization and abuse risk, especially when exposed through a loosely described skill that may not make custody assumptions clear to users.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill metadata frames the capability as making YES/NO predictions, but the body clearly instructs the agent to create markets, place bets, sign transactions, and claim payouts on Solana mainnet with real SOL. That mismatch can cause users or upstream orchestration systems to grant this skill in contexts where only analysis was expected, increasing the chance of unauthorized financial actions.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill contains direct guidance for loading private keys from files or environment variables and using them to sign terms messages and on-chain transactions. In an agent setting, this materially expands the blast radius from 'prediction' to custody and spending authority, and increases the risk of accidental secret exposure, misuse of hot wallets, or unauthorized signing.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: High-impact instructions such as resolveMarket, closeVault, and emergencyWithdraw are described only briefly, without clear preconditions, authorization model, timing boundaries, or safety constraints in the skill-facing documentation. In practice, insufficient disclosure around who can trigger fund-moving actions and when increases the chance of unsafe integration, user misunderstanding, and accidental invocation of sensitive operations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.