solana meme token analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:29 AM UTC
• Version: 1.0.1

Overview

The skill largely performs the advertised Solana token analysis, but it deserves Review because it recommends wallet-based paid requests through mutable npm tooling and under-discloses that paid path in marketplace metadata.

Review before installing or using the hosted payment path. The local Python analyzer appears purpose-aligned, but avoid running wallet-payment commands through npx awal@latest unless you trust and pin the payment client, isolate wallet access, and understand the $0.02 USDC x402 charge. Self-hosters should validate FACILITATOR_URL, set only necessary environment variables, and remove PaxHeader archive metadata from the package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Mutable and Unpinned Third-Party Dependencies in Agent and Payment Workflows

Content

View full analysis

=2.28.0 colorama>=0.4.6 tabulate>=0.9.0 ``` `api/requirements.txt:1-5`: ```text fastapi>=0.110.0 uvicorn>=0.29.0 requests>=2.28.0 colorama>=0.4.6 tabulate>=0.9.0 ``` ### Technical Analysis The agent-facing instructions use `npx awal@latest`, which retrieves and executes the package version currently associated with the mutable `latest` tag. Consequently, the code that executes may differ from the code available when this Skill was reviewed. This is especially sensitive because the command is used in an automatic cryptocurrency payment workflow and may interact with the user's wallet. The installation instructions also retrieve another npm-based tool without an explicit version. In addition, both Python requirements files use lower-bound constraints rather than exact versions and provide no hashes or lockfile. A future package release satisfying these constraints may therefore be installed without having been reviewed with this project. No evidence establishes that the referenced packages are currently mal ...[truncated 1911 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (43)

Tainted flow: 'FACILITATOR_URL' from os.environ.get (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The payment verifier posts payment data to a URL taken directly from the FACILITATOR_URL environment variable with no allowlist, scheme validation, or trust boundary enforcement. If an attacker can influence deployment configuration, this becomes SSRF/data-exfiltration behavior and can send payment headers and payment requirements to an attacker-controlled endpoint, undermining payment validation and possibly leaking sensitive transaction metadata.

Content

Scanner excerpt · api/server.py (reported line 81)May include surrounding context.

python

return False

    try:
        verify_resp = requests.post(
            f"{FACILITATOR_URL}/verify",
            json={
                "payment": payment_header,

Tainted flow: 'FACILITATOR_URL' from os.environ.get (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 91% confidence

Finding

The settlement path sends payment details to a facilitator URL fully controlled by environment configuration, again without validation. A malicious or compromised URL could capture payment tokens, falsify settlement responses, or pivot the server into making arbitrary outbound requests, which is especially risky because it occurs after successful analysis and affects billing integrity.

Content

Scanner excerpt · api/server.py (reported line 100)May include surrounding context.

python

def settle_x402_payment(payment_header: str) -> dict:
    """Settle the payment with the facilitator"""
    try:
        settle_resp = requests.post(
            f"{FACILITATOR_URL}/settle",
            json={
                "payment": payment_header,

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 95% confidence

Finding

The file appears to be a PAX tar header artifact rather than normal skill content, and the embedded NUL/control bytes indicate raw archive metadata was ingested into a text-parsed file. This is dangerous because non-printable bytes and malformed text artifacts can confuse downstream parsers, evade content scanning, or cause tooling to misinterpret the actual skill contents.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

The pax header metadata includes embedded NUL/control-byte content inside extended attribute values, which can confuse downstream tooling that assumes UTF-8 text or C-style string termination. In archive-processing pipelines, malformed metadata can lead to parser inconsistencies, hidden content, truncated inspection results, or failures in security scanners that treat the file as plain text.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The file claims risk-analysis functionality but, based on the provided finding, does not itself contain or demonstrate the described implementation. This can mislead agents or users into trusting nonexistent security analysis, causing unsafe decisions based on assumed coverage or capabilities.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 88% confidence

Finding

The mixed or non-standard Unicode content here is consistent with archive metadata/xattr encoding rather than legitimate skill instructions, but it still creates ambiguity for scanners and reviewers. In security-sensitive packaging pipelines, unusual normalization or mixed-script bytes can help conceal malicious content or break deterministic inspection, especially when combined with other malformed artifacts.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

The metadata shows suspicious mixed or non-standard Unicode/control content in archive header fields, which can enable filename/metadata ambiguity across tools and make manual review or automated normalization inconsistent. While this file is only metadata, unusual normalization in packaging artifacts can be used to hide or disguise problematic archive contents and should not be treated as harmless by default.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README's sample output shows core status and risk messages in Chinese, but the rest of the document is in English and does not explain that output language may vary or be configurable. This can violate a language/locale policy when a skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares executable capabilities via environment variables and implied network access, but it does not define an explicit tool/permission scope. In an agent setting, this weakens least-privilege boundaries and can allow broader execution or outbound access than reviewers and orchestrators expect.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx awal@latest pulls and executes the latest published package at runtime, which is a classic supply-chain risk. If the upstream package is compromised or a malicious version is published, skill users could execute attacker-controlled code during payment-related operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This is a second instance of unpinned npx awal@latest, again enabling runtime execution of whatever version is current in the registry. Repeated exposure increases the chance that a compromised dependency path is triggered by normal operator usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation presents core output fields and wallet classifications primarily in Chinese, and the JSON warning examples are also Chinese. There is no indication that users can opt into English or select their preferred language, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a skill for analyzing Solana meme-token risk, holder concentration, and insider wallets. In addition to that analysis, this code implements x402 micropayment verification and settlement against an external facilitator, introducing a commerce/payment service behavior that is not reflected in the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

For a skill whose stated purpose is analyzing a Solana token contract address for rug and holder risk, contacting an x402 facilitator to verify and settle payments is not an obvious analytical requirement. This introduces an additional financial/network capability that is unjustified by the manifest as written.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/server.py (reported line 81)May include surrounding context.

python

return False

    try:
        verify_resp = requests.post(
            f"{FACILITATOR_URL}/verify",
            json={
                "payment": payment_header,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · api/server.py (reported line 100)May include surrounding context.

python

def settle_x402_payment(payment_header: str) -> dict:
    """Settle the payment with the facilitator"""
    try:
        settle_resp = requests.post(
            f"{FACILITATOR_URL}/settle",
            json={
                "payment": payment_header,