Security audit

solana-token-distribution

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Solana token-distribution skill, but its examples include real mainnet signing and sending patterns with weak transaction safety guardrails.

Review and adapt the examples before using this skill with production wallets. Prefer devnet or localnet first, pin and verify the install source, keep RPC keys and payer keys in a secrets manager, enable preflight or simulation for batches, confirm recipients and total amounts, and avoid JavaScript number arithmetic for token quantities.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:172
Finding: Unpinned Executable Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/batched-airdrop.md:196
Finding: Transaction Preflight Is Disabled in the Batched Airdrop Example
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/batched-airdrop.md:249
Finding: Token Supply Uses an Unsafe JavaScript Number Representation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to install from npx skills add Lightprotocol/skills without pinning a specific package or revision. This creates a supply-chain risk: a future compromised or maliciously updated package/version could be fetched and executed at install time, and npx commonly runs remote package code directly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example is configured for mainnet, creates a mint, mints supply, and submits batched transactions using a real RPC endpoint, but it does not prominently warn that running it will create and move real on-chain assets and incur real fees. In a token-distribution skill, users are likely to copy-paste examples directly, so omission of environment safety guidance materially increases the risk of accidental mainnet execution and unintended asset issuance or fee spend.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This example constructs and submits a real token distribution transaction to multiple recipients, but it does not clearly warn users that running it will move actual assets if valid keys, mint addresses, and recipients are supplied. In a blockchain context, copy-pasting sample code without explicit safety warnings can lead to unintended transfers, especially because the example includes transaction signing and broadcasting logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown demonstrates pulling an RPC API key from an environment variable but gives no handling guidance about protecting credentials, avoiding accidental logging, or scoping the key to intended environments. While this alone is not credential exfiltration, documentation that normalizes direct use of production API keys without warnings can lead to leakage through shell history, screenshots, shared scripts, or misconfigured CI environments.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.