solana-light-sdk

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:15 AM UTC
• Version: 1.0.1

Overview

This Light SDK documentation skill is mostly coherent, but it asks agents to use mutable external install paths and load unreviewed external skills/MCP access during work.

Review before installing. Prefer a pinned commit or signed release instead of the unpinned `npx` command, keep any subagents limited to the intended project directory, and do not expose wallet files, tokens, or unrelated private repositories to DeepWiki MCP or dynamically loaded skills. Treat the Jito example as an explicit third-party transaction submission path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35
• Finding: Unpinned External Package Installation and Dynamic Skill Loading<). Verify the source before running. - **Subagent scope.** This skill may spawn read-only subagents that use `Read`, `Glob`, and `Grep` to search the local repository. Restrict the working directory to your project. ``` ### Technical Analysis The documented installation command invokes an npm-resolved `skills` package through `npx` without specifying an immutable package version. It also installs the Skill from a mutable GitHub repository reference rather than a reviewed commit hash or signed release. The workflow additionally directs agents to load `skills/ask-mcp`, which is not included in the audited project, and to use an external DeepWiki MCP integration. The behavior and instructions supplied by these external components cannot be established from the reviewed files and may change after this audit. This creates a time-of-review versus time-of-use supply-chain gap. If the npm package, GitHub branch, external Skill, maintainer account, or MCP service is compromised or unexpectedly modified, later installations or Skill-loading operations could introduce unreviewed code or instructions. The project contains no evidence that these external components are intentionally malicious. The vulnerability is the absence of immutable versioning and integrity verification around components capable ...[truncated 1934 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the npm package used by `npx` to an explicitly reviewed version: ```bash npx --yes skills@<reviewed-version> add Lightprotocol/skills ``` 2. Pin the installed GitHub source to a reviewed commit SHA rather than a mutable branch or repository head. 3. Record and verify package integrity hashes, release signatures, or checksums before installation. 4. Do not automatically load `skills/ask-mcp`. Vendor it into the reviewed package or require a separate security review and explicit user approval before activation. 5. Treat MCP responses and remotely sourced Skill instructions as untrusted input. Do not permit them to override system constraints, expand filesystem scope, or initiate execution without confirmation. 6. Run installation and external Skill operations in a sandbox with: - Access limited to the intended project directory. - No wallet files, signing keys, tokens, or unrelated environment variables. - Restricted outbound network access. - No elevated operating-system privileges. 7. Change the workflow so local documentation and read-only repository inspection are attempted first. External Skill loading should be optional rather than a default recovery step. 8. Maintain a dependency lockfile or reviewed manifest documenting the exact npm package version, Git commit, external Skill revision, and MCP endpoint configuration. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

• Category: analysis-evasion

Content

| Anchor pattern | [references/anchor.md](references/anchor.md) |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Memory Manipulation

High

• Category: Memory Poisoning

Content

| | Hot market (99%+) | Cold market |
|---|---|---|
| Quoting | No change | No change |
| Swap instruction | No change | No change |
| Transaction | No change | Prepend `create_load_instructions` |

## Detecting cold accounts

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| | Hot market (99%+) | Cold market |
|---|---|---|
| Quoting | No change | No change |
| Swap instruction | No change | No change |
| Transaction | No change | Prepend `create_load_instructions` |

## Detecting cold accounts

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

| | Hot market (99%+) | Cold market |
|---|---|---|
| Quoting | No change | No change |
| Swap instruction | No change | No change |
| Transaction | No change | Prepend `create_load_instructions` |

## Detecting cold accounts

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## FAQ

**Do I need to change my swap instructions?**

No. Swap instructions are identical. If the market is hot, the transaction
is the same as today. If cold, you prepend `create_load_instructions`.

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Do I need to change my swap instructions?**

No. Swap instructions are identical. If the market is hot, the transaction
is the same as today. If cold, you prepend `create_load_instructions`.

**Can I quote cold markets?**

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

// ... build and send init instruction ...

    // 2. Swap (hot path - works normally)
    // ... build and send swap instruction ...

    // 3. Trigger compression (advance time)
    rpc.warp_slot_forward(SLOTS_PER_EPOCH * 30).await.unwrap();

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: The skill recommends installation via `npx skills add Lightprotocol/skills` without pinning a specific package version or immutable commit reference. Because `npx` resolves and executes remote package code at runtime, a compromised upstream package, dependency, or later package update could cause users to run unexpected code during installation, creating a supply-chain execution risk.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: This markdown file includes example code that posts bundle data to an external Jito endpoint, which is a network operation that transmits transaction data off-box. The surrounding documentation explains how to do it but does not include any warning or disclosure about sending data to a third-party service.

Static analysis

No suspicious patterns detected.