Security audit

Tokenized agents pump.fun

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherently about Solana wallet payments, but it tells agents to follow changeable remote instructions in a payment flow.

Review this skill before installing in production payment projects. Prefer a version that uses the bundled reference files or commit-pinned links, pin npm dependencies with a lockfile, disclose wallet auto-reconnect behavior, and verify that every transaction shown to the user matches the intended amount, currency, and recipient before signing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:124
Finding: Mandatory Use of Mutable Remote Instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/WALLET_INTEGRATION.md:6
Finding: Wallet Dependencies Are Installed Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:71
Finding: Core Solana Dependency Resolution Is Not Fully Reproducible
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.
md
### Parameters (`BuildAcceptPaymentParams`) | Parameter | Type | Description | | ------------------ | ---------------------------- | ---------------------------------------------------------------------------------------------------- | | `user` | `PublicKey` | The payer's wallet address | | `currencyMint` | `PublicKey` | Mint address of the payment currency (USDC, wSOL) |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown instructs users to enable autoConnect on the wallet provider, which can automatically reconnect to a previously selected wallet when the app loads. The document does not warn that this affects wallet connection behavior or user privacy expectations, even though it changes how the application interacts with the user's wallet.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The layout example sets <html lang="en">, which enforces an English locale in the sample without mentioning user selection or a region-specific requirement. Under the policy, language constraints should either be optional for the user or clearly justified.
Content: No source excerpt is available for this finding.