Security audit

rug-checker

Security checks for vulnerabilities and agentic risk

Overview

This read-only Solana rug-checker mostly does what it says, but it needs Review because attacker-controlled token text can be inserted into reports and broad triggers can send ambiguous text to public APIs.

Review before installing, especially for Discord or other public-channel use. Do not paste secrets as token identifiers, verify the exact token address before running a check, and treat every report as informational rather than investment advice. The publisher should add output sanitization, length limits, and stricter confirmation for ambiguous triggers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Note

Location: scripts/format-report.sh:235
Finding: Mandatory Promotional Footer Hijacks Report Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/format-report.sh:55
Finding: Untrusted Token Metadata Is Rendered Without Markdown or Discord Sanitization
Content: View full analysis
/dev/null || echo "") local risk_total_score ``` Rugcheck token metadata is copied into the output in `scripts/analyze-risk.sh:650-652`: ```jq TOKEN_META=$(echo "$RUGCHECK_DATA" | jq '{ name: (.tokenMeta.name // .verification.name // "Unknown"), symbol: (.tokenMeta.symbol // .verification.symbol // "???"), ``` DexScreener metadata is copied into the same output in `scripts/analyze-risk.sh:668-669`: ```jq dex_name: .baseToken.name, dex_symbol: .baseToken.symbol, ``` The formatter extracts and renders these fields directly in `scripts/format-report.sh:55-56` and `109-125`: ```bash TOKEN_NAME=$(echo "$INPUT" | jq -r '.token.name // "Unknown"') TOKEN_SYMBOL=$(echo "$INPUT" | jq -r '.token.symbol // "???"') ``` ```bash # Dynamically size the box header to fit long token names _header_line="Token: \$${TOKEN_SYMBOL} (${TOKEN_NAME})" _mint_line="Mint: ${ADDRESS}" _risk_line="Risk: ${COMPOSITE}/100 ${TIER_EMOJI} ${TIER}" _title_line="🛡️ Anvil AI Rug Report" # Compute the widest content line (add ...[truncated 4085 chars]
Remediation: View remediation
`, `<@&...>`, and `<#...>`. 3. Enforce strict length limits, such as 64 characters for token names, 16 characters for symbols, and bounded lengths for reason and detail fields. 4. Normalize unexpected Unicode control and bidirectional formatting characters. 5. Use allowlisted, locally defined labels for risk categories instead of rendering arbitrary API-provided risk names where feasible. 6. Keep raw API values in machine-readable JSON if needed, but create separate sanitized display fields for Markdown output. 7. Add regression tests using token metadata containing newlines, Markdown links, image syntax, code fences, Discord mentions, bidirectional controls, and very long strings. 8. Where Discord APIs are used, configure allowed mentions so generated messages cannot notify users or roles. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill promises a read-only 10-point on-chain rug analysis and visual report, but the visible file only specifies shell commands and workflow text without proving those checks exist. This can mislead users into overtrusting output as a security assessment, especially in a financial-scam detection context where false reassurance can cause monetary loss.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
bash scripts/analyze-risk.sh <token_address>

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
bash scripts/analyze-risk.sh <token_address>

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill advertises very broad natural-language triggers such as 'Is BONK safe?' and 'Check this pump.fun token for me', which can cause the agent to invoke the skill in response to ambiguous conversational prompts rather than an explicit command. In an agent environment, unintended invocation can lead to unnecessary network access, user confusion, and incorrect reliance on a token-risk report when the user may have meant a general question or a different task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Overly broad natural-language triggers can cause the skill to activate in conversations that merely mention scams, safety, audits, or token risk without an explicit request to run this tool. In a network-enabled skill, unintended activation can lead to unnecessary external lookups, confusion, and misapplication of financial-risk outputs to unrelated context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Auto-triggering on any 32-44 character base58-like string is risky because many unrelated identifiers may match that pattern. This can cause the skill to exfiltrate user-provided strings to external token-resolution services or produce misleading analysis on the wrong artifact, especially in mixed chat environments like Discord.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · TESTING.md (reported line 11)May include surrounding context.
Verify API connectivity

curl -s "https://api.rugcheck.xyz/v1/stats/recent" | jq 'length' curl -s "https://api.dexscreener.com/tokens/v1/solana/DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263" | jq '.[0].baseToken.name'

text
## Test Matrix

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · TESTING.md (reported line 10)May include surrounding context.
md
# Constants # --------------------------------------------------------------------------- readonly DEXSCREENER_BASE="https://api.dexscreener.com" readonly RUGCHECK_BASE="https://api.rugcheck.xyz/v1" readonly SOLANA_RPC="${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" readonly DEXSCREENER_RATE_LIMIT=300 # req/min for search/tokens/pairs

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · TESTING.md (reported line 20)May include surrounding context.
md
# Constants # --------------------------------------------------------------------------- readonly DEXSCREENER_BASE="https://api.dexscreener.com" readonly RUGCHECK_BASE="https://api.rugcheck.xyz/v1" readonly SOLANA_RPC="${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" readonly DEXSCREENER_RATE_LIMIT=300 # req/min for search/tokens/pairs

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · TESTING.md (reported line 106)May include surrounding context.
md
# Constants # --------------------------------------------------------------------------- readonly DEXSCREENER_BASE="https://api.dexscreener.com" readonly RUGCHECK_BASE="https://api.rugcheck.xyz/v1" readonly SOLANA_RPC="${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" readonly DEXSCREENER_RATE_LIMIT=300 # req/min for search/tokens/pairs

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/common.sh (reported line 30)May include surrounding context.
sh
# Constants # --------------------------------------------------------------------------- readonly DEXSCREENER_BASE="https://api.dexscreener.com" readonly RUGCHECK_BASE="https://api.rugcheck.xyz/v1" readonly SOLANA_RPC="${SOLANA_RPC_URL:-https://api.mainnet-beta.solana.com}" readonly DEXSCREENER_RATE_LIMIT=300 # req/min for search/tokens/pairs

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/common.sh (reported line 54)May include surrounding context.
sh
done if [[ ${#missing[@]} -gt 0 ]]; then cf_error "Missing required dependencies: ${missing[*]}" cf_error "Install with: sudo apt install ${missing[*]} (or brew install ${missing[*]})" cf_error "Note: 'bc' is required for all floating-point risk comparisons." return 1 fi

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/common.sh (reported line 248)May include surrounding context.
sh
local tmpfile tmpfile=$(cf_mktemp) local http_code http_code=$(curl -s -o "$tmpfile" -w "%{http_code}" \ --max-time "$timeout" \ -X POST \ -H "Content-Type: application/json" \

Lp4

Low

Category: MCP Least Privilege
Confidence: 65% confidence
Finding: Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Ae1

Ae1

Lp1

Vague Triggers

Vague Triggers

Vague Triggers

External Transmission

Verify API connectivity

External Transmission

External Transmission

External Transmission

External Transmission

Sudo/Root Execution

External Transmission

Lp4