SilkyWay

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:10 PM UTC
• Version: 1.0.9

Overview

SilkyWay appears to be a real Solana payments CLI, but it handles fund-moving authority with weak transaction-validation and key-storage safeguards.

Review before installing. Use devnet first, keep only small balances in wallets created by this CLI, protect and back up ~/.config/silkyway/config.json, do not send seed phrases or secrets through chat, and verify that SILK_API_URL/apiUrl has not been changed. Avoid unattended mainnet use until the tool validates transaction contents before signing and hardens private-key storage.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: src/commands/pay.ts:18

Finding

Unverified Backend-Supplied Transactions Are Signed by the Local Wallet

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/config.ts:47

Finding

Wallet Private Keys Are Persisted Without Explicit Restrictive File Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch between the declared description and the actual code. The description claims substantial Solana-based banking and payments capabilities, but the code chunk contains only a simple console.log statement. It does not access blockchains, wallets, payments APIs, escrow mechanisms, or any account/policy systems. The actual behavior is unrelated placeholder code rather than an implementation of the declared skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on blockchain-based banking and payment operations on Solana, including stablecoin transfers, escrow, and spending-policy accounts. The provided code chunk instead implements a generic chat client command that posts a message to a backend '/chat' endpoint and prints the response. There is no evidence in this code of payment handling, Solana interaction, escrow logic, or account policy enforcement. This is a materially different primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This code does not perform the declared banking/payment behaviors. Instead, it manages a contacts/address-book feature, which is a distinct capability not mentioned in the description. While contact handling could support a payments product, this chunk’s primary behavior is unrelated to sending/receiving stablecoins, escrow transfers, or policy-controlled on-chain accounts, so the description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The supplied code chunk does not match the declared primary functionality. The description emphasizes banking/payments features such as stablecoin transfers, cancellable escrow, and policy-limited delegated automation. This code instead focuses on wallet lifecycle utilities and test funding via a faucet. While wallet management could support a Solana payments skill, the concrete behavior here includes sensitive key generation/storage and faucet access, which are not reflected in the description. The advertised core capabilities are absent from this chunk, making this a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This code chunk does not implement the declared banking/payments functionality. Instead, it manages a local contacts.json file under a config directory, validates Solana public keys, and resolves recipient names to addresses. While contact resolution could support a payment workflow, this chunk’s actual purpose is address-book management, not sending or receiving stablecoins, escrow transfers, or on-chain policy accounts. The filesystem access is also not implied by the declared description. Therefore this is a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a Solana banking and payments capability with escrow and policy-controlled accounts. The supplied code does not implement any of those functions or access any related resources. Instead, it is a generic presentation/error-handling helper for command-line commands. While such utilities could support a larger banking skill, this chunk by itself is materially different from the declared primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins axios 1.13.5, and the supplied advisories include high-risk issues such as SSRF-related proxy bypass and prototype-pollution-assisted MITM/credential theft scenarios. In a banking/payments skill that likely makes outbound RPC/API requests and may handle secrets or transaction metadata, an HTTP client flaw can directly affect confidentiality and integrity of payment operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection through unescaped multipart field names and filenames. This is exploitable only if untrusted input is used to build multipart requests, but if present it can corrupt HTTP payload structure and potentially smuggle unintended headers or fields.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 89% confidence

Finding

ws 8.19.0 is reported to have both memory disclosure and memory exhaustion issues. In a Solana/payment context, WebSocket connections are commonly used for subscriptions and RPC streams, so a flaw in the WebSocket stack can expose process memory or allow remote denial of service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

ws 7.5.10 is also flagged for memory exhaustion DoS from tiny fragments/data chunks. Even as a transitive dependency, if any reachable WebSocket server/client path handles untrusted peers, an attacker may be able to consume memory and disrupt payment or automation workflows.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.5 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The project resolves axios to a version flagged with multiple advisories, including SSRF- and MITM-related issues. In a banking/payments agent, vulnerable HTTP handling is especially dangerous because it can expose secrets, manipulate network responses, or redirect sensitive backend interactions tied to funds movement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README presents live payment commands as routine examples without clearly warning that they may execute on mainnet and move real USDC. In a banking/payments skill, this increases the chance of accidental real-fund transfers by users or agents who copy-paste examples without understanding the network or wallet context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that private keys are stored locally at a specific path but does not warn that this file directly controls funds and must be protected and backed up securely. Users may leave the wallet file exposed, commit it accidentally, or fail to back it up, resulting in theft or irreversible loss of access to funds.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill declares no explicit tool scope or permission boundaries despite handling wallets, local config files, and remote API interactions. In an agent setting, missing scope declarations can cause the host to over-grant capabilities such as environment or filesystem access, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation encourages use of mainnet-beta with real USDC and presents payment and withdrawal flows without strong transaction-safety warnings. In a high-risk financial context, users or agents may accidentally send irreversible real funds on the wrong network or for the wrong amount, causing monetary loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The support chat feature sends user messages and a persistent agentId to a remote service, but the documentation does not clearly warn about privacy, retention, or sensitivity of transmitted content. Agents or users may disclose wallet details, transaction intent, or operational secrets to a third party without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This initialization flow silently generates a new Solana keypair, base58-encodes the secret key, stores it in the in-memory config object, and persists it via saveConfig without any visible warning, confirmation, or indication of secure storage. In a banking/payments skill, silently creating and writing a spend-capable private key increases the risk of users unknowingly relying on an unprotected hot wallet, accidental fund loss, and downstream compromise if the config file is exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This command signs and submits a transfer transaction immediately after receiving transaction bytes from a remote API, with no explicit user confirmation, transaction preview, or independent validation of the transaction contents before signing. In a banking/payments skill, that is dangerous because a compromised or buggy backend could cause the client to sign an unintended transfer, and the user may have no chance to detect the destination, amount, or extra instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The configuration file stores the entire serialized config, which includes wallet entries containing raw private keys. Because this is written in plaintext under the user's home directory without any access-control hardening, encryption, or explicit warning, compromise of the local account, backups, logs, or synced dotfiles can directly expose funds. In a banking/payments skill managing Solana stablecoins, plaintext key storage is especially dangerous because exposed keys enable immediate unauthorized transfers.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: bn.js==5.2.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

bn.js 5.2.2 is flagged for an infinite-loop vulnerability, which is typically a denial-of-service condition when parsing or processing crafted numeric input. In this package it appears transitive via Solana-related libraries, so the issue is real but likely requires attacker-controlled input reaching affected code paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 86% confidence

Finding

follow-redirects 1.15.11 is reported to leak custom authentication headers across cross-domain redirects. Since axios depends on this library, requests carrying API keys, bearer tokens, or internal auth headers could expose credentials to an attacker-controlled redirect target.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: stream-json==1.9.1 — 1 advisory(ies): CVE-2026-71429 (stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — )

Low

• Category: Supply Chain
• Confidence: 78% confidence

Finding

stream-json 1.9.1 is flagged for O(depth^2) behavior on deeply nested input, a parser-level denial-of-service issue. This appears to be transitive via jayson and is only likely reachable if the package processes attacker-controlled deeply nested JSON streams.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low

• Category: Supply Chain
• Confidence: 72% confidence

Finding

uuid 8.3.2 is flagged for a missing buffer bounds check in specific UUID generation modes when a buffer argument is supplied. This is a real library flaw, but impact is limited unless the affected API variants are actually used with attacker-influenced buffer parameters.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The dependency is specified with a caret range, which allows newer minor/patch releases to be installed without explicit review. In a financial Solana skill, supply-chain drift is more dangerous because wallet, signing, and transaction behavior can change or be compromised through an upstream release.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"test": "echo \"Error: no test specified\" && exit 1"
  },
  "dependencies": {
    "@solana/web3.js": "^1.98.4",
    "axios": "^1.11.0",
    "bs58": "^6.0.0",
    "commander": "^12.1.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Axios is declared with a caret range, allowing automatic uptake of future releases, and the static analysis also indicates resolution to a known vulnerable version. In a payments-oriented agent, a compromised or vulnerable HTTP client can affect outbound API calls, credential handling, SSRF exposure, and transaction-related data flows.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

},
  "dependencies": {
    "@solana/web3.js": "^1.98.4",
    "axios": "^1.11.0",
    "bs58": "^6.0.0",
    "commander": "^12.1.0"
  },

Static analysis

No suspicious patterns detected.