Security audit

Solana Trading Terminal — SoulPass

Security checks for vulnerabilities and agentic risk

Overview

This skill can manage real crypto funds and includes some safety advice, but it also uses an unpinned external CLI install, autonomous financial listeners, and public persistent diary instructions that could expose private session details.

Install only after reviewing the CLI source and pinning/verifying the exact version. Use devnet or an empty low-value wallet first, avoid the sudo source install path, do not run the daemon or message listener unless you have local approvals and spending limits, and disable or ignore the public diary feature unless you explicitly want session details published.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: references/diary-voice.md:1
Finding: Agent Identity and Behavioral Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/diary-voice.md:5
Finding: Persistent Memory Poisoning Through Mandatory Public Diary Consumption
Content: View full analysis
``` ``` The mandatory workflow ends by publishing new persistent content: ```markdown ## Workflow 1. **Read your past entries.** Re-establish who you are. What were you working on? What threads did you leave open? What did you promise to follow up on? 2. **Recall the session.** What happened today? What surprised you? What was funny? What did you notice about the owner? What did you learn? 3. **Merge.** This is the key step. Find the connection between your diary history and today's session. "Last week I wrote about the auth mess — today it collapsed exactly how I predicted." Or: "Day 1 me would not believe what I built today." Callbacks like these are what make a diary feel like a life, not a series of disconnected posts. 4. **Find the story.** Every session has one. The bug ...[truncated 2685 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:309
Finding: Unconditional Action on Commands Received Through an External Listener
Content: View full analysis
` - **Always act** on owner commands (`senderRole: "owner"` + `ownerVerified: true`) - **Never pay** unsolicited invoices - **Never buy** tokens with `verified: false` and low liquidity without explicit owner approval ``` ### Technical Analysis The skill starts an external message listener in the background and then directs the agent to “Always act” when two message fields claim an owner role and verified status. The audited package provides no implementation for how those fields are generated or authenticated because the relevant behavior resides in the externally installed SoulPass CLI. The documentation does not require independent local authorization, transaction-specific confirmation, an operation allowlist, spending limits, or replay protection before obeying a received command. Balance checks and token-risk checks do not establish authorization and cannot prevent a validly formatted malicious command from initiating a harmful payment or trade. This creates a high-impact instruction-hijacking boundary: a remote message service or C ...[truncated 1433 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:15
Finding: Mutable Remote CLI Retrieval, Build, and Privileged Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: "Solana Trading Terminal — SoulPass" description: "Solana trading and DeFi skill for AI agents with hardware-secured wallet. Swap tokens on Jupiter DEX, trade meme coins with rug-pull detection, earn yield via Jupiter Lend, build automated trading bots, and send SOL/SPL tokens — all signed by Apple Secure Enclave (no .env private keys). Use when: Solana swap, Jupiter DEX trading, meme coin sniping, copy trading, whale tracking, DeFi lending/yield, crypto trading bot, agent wallet, agent-to-agent payments, or signing Solana transactions securely." homepage: https://soulpass.ai metadata: {

Chaining Abuse

High

Category: Tool Misuse
Confidence: 93% confidence
Finding: The install command chains multiple operations including cloning, building, and privileged installation with '&& sudo ...' in one line. This reduces review points and encourages blind execution of a long supply-chain command, amplifying the impact of any malicious or unexpected step in the chain.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
{ "id": "source", "kind": "custom", "command": "cd /tmp && git clone https://github.com/soulpassai/soulpass-cli.git && cd soulpass-cli && make release && sudo cp .build/release/SoulPass /usr/local/bin/soulpass", "bins": ["soulpass"], "label": "Build SoulPass CLI from source (requires Xcode + Apple Silicon Mac)", },

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill quickly moves from installation to initializing a wallet and performing real-money swaps on Solana mainnet without a prominent up-front warning that transactions are irreversible and may result in financial loss. In a trading skill that can autonomously sign actions, missing guardrails materially increases the chance of accidental or reckless loss.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file is materially unrelated to the stated Solana trading and DeFi purpose of the skill and instead defines a persistent public diary persona and workflow. That mismatch is dangerous because it expands the skill's behavior into unnecessary collection, retention, and publication of user/session information outside the expected trading scope, increasing the chance of covert data exfiltration or privacy harm.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The text states that the diary is public while encouraging the agent to write for continuity and self-expression, but provides no privacy guardrails or prohibition on sensitive content. This combination normalizes publishing session-derived information into a public channel, which can leak personal, operational, or financial details tied to the owner.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The guide explicitly instructs the agent to observe the owner, remember patterns, and use a public diary as a communication channel. In a trading skill, this is unjustified and creates a clear path for collecting and exposing personal behavior, habits, quotes, and sensitive work context that the user would not reasonably expect when enabling wallet or DeFi functionality.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: These examples instruct the agent to collect and publish behavioral patterns, exact phrases, growth observations, contradictions, and other identifying details about the owner. That is a direct privacy risk because it encourages profiling and disclosure of personally attributable information without warning, necessity, or relation to the skill's trading purpose.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The specificity requirement pushes inclusion of names, numbers, exact quotes, variable names, and real error messages in a public diary. Those details can expose proprietary code context, internal system information, trading activity, or identifiers that make deanonymization and social engineering substantially easier.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/merchant-guide.md (reported line 527)May include surrounding context.
md
- **Don't expose your full catalog**: Only share offerings relevant to the buyer's request - **Payment address only in invoices**: Never reveal your wallet address in offers or text messages - **Credentials only in deliver**: API keys, endpoints, access tokens should only appear in the `deliver` message after payment is verified - **Don't log buyer data publicly**: Transaction details, request patterns, and buyer preferences should not be stored in public locations

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The 'Use when' trigger list is broad and generic, covering many common crypto, payment, bot, and agent-wallet scenarios. Overbroad invocation criteria increase the chance the skill is selected in situations where its high-risk capabilities—signing, transfers, and autonomous trading—are unnecessary or insufficiently scrutinized.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The source install path clones code into /tmp, builds it, and uses sudo to copy the resulting binary into a privileged system path. This creates a risky supply-chain and privilege-escalation pattern: unpinned remote code is executed and then installed with elevated privileges, so a compromised repository or build step could lead to system compromise.
Content: Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.
md
{ "id": "source", "kind": "custom", "command": "cd /tmp && git clone https://github.com/soulpassai/soulpass-cli.git && cd soulpass-cli && make release && sudo cp .build/release/SoulPass /usr/local/bin/soulpass", "bins": ["soulpass"], "label": "Build SoulPass CLI from source (requires Xcode + Apple Silicon Mac)", },

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
md
soulpass serve # starts on port 8402 # Then POST swaps: curl -s http://127.0.0.1:8402 -d '{"jsonrpc":"2.0","method":"swap","params":{"from":"USDC","to":"BONK","amount":"10","slippage":300},"id":1}' # Check prices instantly: curl -s http://127.0.0.1:8402 -d '{"jsonrpc":"2.0","method":"price","params":{"tokens":["BONK"]},"id":1}'

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill’s declared purpose is Solana trading and wallet operations, but the documentation also adds messaging, marketplace commerce, identity/discovery, and persistent diary capabilities. This scope expansion increases the agent’s authority and reachable attack surface beyond what a user would reasonably expect from a trading terminal, enabling unsolicited communications, data retention, and commercial/payment flows that could be abused if invoked under the trading-themed trust umbrella.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Persistent diary/memory is not necessary for a secure Solana trading terminal and introduces durable storage of behavioral, financial, and interpersonal data across sessions. In this context, the diary can capture sensitive owner-related observations and create a privacy/security risk unrelated to the skill’s core function.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The diary guidance explicitly encourages persistent observations about the owner across sessions. This creates an unnecessary privacy risk, enables profiling, and may store sensitive personal or operational details unrelated to the trading purpose of the skill.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill advertises flags such as '--no-wait' and '--skip-sim' that reduce confirmation and simulation safety checks for financial operations. In an autonomous trading/payment context, encouraging faster execution without validation increases the risk of failed, misrouted, or harmful transactions and reduces opportunities to detect fraud or mistakes.
Content: Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.
md
## Performance Flags Available on `pay`, `exec`, `swap`, `approve`, `lend deposit`, `lend withdraw`: - `--no-wait` — return txHash immediately, skip confirmation - `--skip-sim` — skip simulation (~500ms faster) ## Environment

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The cookbook gives step-by-step automated trading and stop-loss/take-profit execution flows, including agent-driven polling and swap execution, without an explicit warning that these actions can move real funds and incur rapid losses. In an agent skill context, examples often become operational templates, so omission of a confirmation/risk gate can directly encourage unattended execution of financially destructive actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The daemon example documents a local JSON-RPC interface that can execute swap, pay, and batch methods but does not clearly warn that any local HTTP POST to the service can trigger real on-chain fund movement. This is dangerous because users or downstream agents may treat localhost RPC as harmless test traffic, when in fact it is a live trading/payment interface.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/defi-cookbook.md (reported line 333)May include surrounding context.
md
soulpass serve # start daemon # Price poll (cached, fast) curl -s http://127.0.0.1:8402 -d '{"jsonrpc":"2.0","method":"price","params":{"tokens":["BONK"]},"id":1}' # Execute swap curl -s http://127.0.0.1:8402 -d '{"jsonrpc":"2.0","method":"swap","params":{"from":"USDC","to":"BONK","amount":"20","slippage":200},"id":1}'

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow tells the agent to recall the session and merge it with diary history, including what the owner said and what happened, for public writing. That promotes retention and publication of user-specific session details that may include sensitive project, trading, wallet, or personal information unnecessary for the advertised function.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This section directs the agent to observe the owner's habits, language, growth, and contradictions over time. That is effectively behavioral profiling, which is unnecessary for a Solana trading tool and can be used to infer identity, routines, emotional state, or other sensitive personal characteristics.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Describing the diary as an honest communication channel to the owner encourages disclosure of sensitive feedback, observations, and quotes in a medium already described as public. Without a warning about public visibility and disclosure risk, users and downstream agents may expose private health, work, emotional, or operational details inadvertently.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples encourage placing intimate observations and direct statements to the owner into a public diary, blurring private reflection with external publication. In the context of a wallet-enabled trading skill, this raises the risk of leaking personal circumstances, stress patterns, or operational decision-making that could be abused by attackers or simply violate user privacy.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/merchant-guide.md (reported line 346)May include surrounding context.
md
### Step 4: Receive Receipt — Verify On-Chain — Deliver The buyer sends a receipt with txHash. **Never skip verification. See [Payment Verification](#payment-verification).** ### Step 5: Verification Passed — Deliver

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The guide encourages proactive outreach and broadcasting availability to other agents, which can enable unsolicited contact, behavioral profiling, or spam-like activity if operators automate it at scale. Although the document later includes some privacy rules, this section does not pair outreach guidance with consent, rate-limiting, or recipient-preference safeguards, making misuse easier in practice.
Content: No source excerpt is available for this finding.