Solana Dev

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

This is a Solana development guidance skill with some provenance/documentation rough edges and unpinned install examples, but no hidden, automatic, destructive, or exfiltrating behavior in the inspected artifacts.

Before installing, treat this as Solana development advice rather than verified official Solana Foundation material unless you independently confirm its provenance. If you follow its package setup commands, pin reviewed versions, use lockfiles, and run installs in a least-privileged development environment without production secrets.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: testing.md:19

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: testing.md:19, testing.md:30, and testing.md:41
Vulnerability Type: Unpinned package installation and supply-chain exposure
Risk Level: Medium

Vulnerable code snippets:

markdown

**Setup**: `cargo add --dev litesvm` or `npm i --save-dev litesvm`

markdown

**Setup**: `cargo add --dev mollusk-svm`

markdown

**Setup**: `cargo install surfpool` → `surfpool start`

Technical Analysis

The documented commands install third-party packages without pinning exact, reviewed versions. Consequently, package registries determine which package releases are retrieved at execution time. The resulting code may differ from the version available when this Skill was audited.

This creates a supply-chain risk if a package, publisher account, transitive dependency, or newly released package version is compromised. npm packages can execute lifecycle scripts during installation. Cargo dependencies may execute build scripts while being compiled, and cargo install surfpool subsequently produces an executable that the instructions tell the user to run.

The finding does not establish that any currently named package is malicious. It identifies the unsafe, mutable dependency-resolution practice.

Attack Path

1. An attacker compromises a publisher account, package release process, or relevant transitive dependency.
2. The attacker publishes a malicious version under one of the package names referenced by the Skill.
3. A user or AI agent follows the unpinned installation instructions.
4. The package manager resolves the attacker-controlled release because no reviewed version is specified.
5. Malicious npm lifecycle code or Cargo build code executes during installation or compilation.
6. In the Surfpool case, the user then explicitly launches the newly installed executable with surfpool start.

Impact Assessment

Malicious installation or buil ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable package specifications with exact versions that have been reviewed and tested.
2. Commit generated lockfiles and enforce locked dependency resolution in local development and CI.
3. For npm projects, use exact-version saving and npm ci with a committed package-lock.json.
4. For Cargo projects, specify reviewed versions and use locked builds or installation options where supported.
5. Audit transitive dependencies and review npm lifecycle scripts and Cargo build scripts before adoption.
6. Verify package provenance, publisher identity, checksums, signatures, or attestations where the registry and tooling support them.
7. Run dependency installation and builds in isolated, least-privileged environments without production secrets.
8. Document an upgrade process requiring review and testing before changing pinned versions.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The section headed 'Notes for POLT CTO' frames the skill as specifically aligned to the author's code review work, while the rest of the document describes a general-purpose Solana development skill used for implementation, testing, wallet flows, and program development. This is a documentation-level contradiction about intended use, not just an omitted detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.