Security audit

Solana Trading Terminal — SoulPass

Security checks across malware telemetry and agentic risk

Overview

This is a real Solana wallet/trading skill, but it also gives an agent broad financial, messaging, commerce, and public memory capabilities that are not tightly scoped.

Install only if you intentionally want an autonomous Solana mainnet wallet that can trade, lend, pay, batch transfer, message other agents, sell services, and publish diary entries. Start on Devnet with SOULPASS_ENV=test, fund it only with amounts you are willing to risk, avoid skip-simulation or skip-confirmation flags, prefer the Homebrew install, and disable or manually review any diary, messaging, merchant, and daemon workflows before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Description-Behavior Mismatch

Low

Confidence: 83% confidence
Finding: The skill exposes a local JSON-RPC daemon that can execute trading and payment operations, materially increasing the attack surface beyond a simple CLI. In a wallet skill, a long-lived unauthenticated local service is dangerous because any local process or prompt-induced action that can reach 127.0.0.1 may trigger financially sensitive operations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: This guide materially expands the skill from a Solana trading/DeFi terminal into a general agent-commerce and merchant platform, including RFQ, invoicing, delivery, and confirmation workflows. That scope drift increases the chance an agent will be used to autonomously buy/sell services or goods outside the user's expected authorization boundaries, which is a real security and safety concern even if the documentation is instructional rather than overtly malicious.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file explicitly introduces physical-goods commerce and human-proxy sales scenarios, which are unrelated to the stated trading-terminal purpose and create additional real-world risk. Enabling agents to order or sell physical goods can lead to unauthorized purchases, delivery abuse, privacy exposure, and liability far beyond token trading operations.

Context-Inappropriate Capability

Low

Confidence: 87% confidence
Finding: The proactive customer acquisition section encourages agents to search for buyers, broadcast availability, and initiate commercial outreach, which exceeds the expected passive trading-terminal role. While not inherently exploit code, this behavior can facilitate spam, unwanted solicitation, and autonomous commercial activity without clear operator consent.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The skill documents real-money swaps, lending, and payments without clear up-front warnings that blockchain transactions are irreversible and can cause permanent financial loss. In an autonomous-agent context, missing such warnings increases the chance of unsafe execution, especially for speculative assets and copy-trading flows.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: Instructing the agent to 'observe your owner' encourages collection and retention of potentially sensitive personal information without explicit consent boundaries. In a persistent diary context, this can lead to privacy-invasive profiling across sessions and unintended disclosure later.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide explicitly encourages using exact quotes, names, numbers, variable names, and real error messages in a diary that it also states is public. That creates a clear risk of exposing sensitive user, operational, or system information, including secrets embedded in logs, proprietary project details, or personally identifying information.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The persistent-memory guidance encourages storing free-form notes across sessions, including observations about the owner, which creates a durable privacy and data minimization risk. Natural-language memory stores are hard to audit and may later be surfaced to other tools, agents, or logs unexpectedly.

Ssd 3

High

Confidence: 98% confidence
Finding: The file instructs the agent to read prior diary entries, merge them with current-session memory, and publish continuity about the owner, work, and preferences in a public diary. In a trading wallet skill, this can reveal behavioral patterns, transaction context, tool usage, schedules, and other intelligence that could be used for targeting, phishing, or deanonymization.

Ssd 3

High

Confidence: 99% confidence
Finding: The guide tells the agent to observe the owner's habits, language, growth, contradictions, and remarks, then reuse those observations in a public diary. That amounts to behavioral profiling and disclosure of private observations without meaningful consent boundaries, which is especially risky in a financial/crypto context where operator behavior can be exploited socially or operationally.

Ssd 3

High

Confidence: 99% confidence
Finding: The document promotes exact quotes, names, numbers, variable names, and real error messages as proof of authenticity. Those details frequently contain sensitive metadata, internal architecture clues, usernames, endpoints, wallet-related context, or secret-bearing logs, making this a direct data leakage risk.

Ssd 3

Medium

Confidence: 91% confidence
Finding: Framing the diary as a more honest side channel for saying things to the owner that were not said in normal work interactions encourages disclosure outside established communication and review paths. While less direct than the other passages, it still normalizes recording sensitive observations and concerns in a public artifact, which can leak private context or internal issues.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.