wallet-pnl

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:37 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform Solana wallet analysis, but it should be reviewed because it documents a mutable npx payment command and under-scoped paid/network behavior.

Review before installing or invoking the paid path. Do not run the documented npx awal@latest command in a privileged environment; prefer a pinned, reviewed payment client and confirm any paid request before sending a wallet address. Self-hosters should remove PaxHeader packaging artifacts, pin dependencies, restrict or validate FACILITATOR_URL, remove unused balance/token-account queries unless documented, and add rate limits or payment checks to /demo if production access should be paid.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/pnl.py:60

Finding

Unnecessary Retrieval of Wallet Balance and Token Holdings

Content

View full analysis

float: """Get current SOL balance via public RPC""" rpc_url = (f"https://mainnet.helius-rpc.com/?api-key={HELIUS_KEY}" if HELIUS_KEY else "https://api.mainnet-beta.solana.com") try: r = requests.post(rpc_url, json={ "jsonrpc": "2.0", "id": 1, "method": "getBalance", "params": [wallet] }, headers=HEADERS, timeout=8) if r.status_code == 200: res = r.json().get("result", {}) if isinstance(res, dict) and "value" in res: return res["value"] / 1e9 except Exception: pass return -1 def fetch_token_accounts(wallet: str) -> list: """Get current token holdings""" rpc_url = (f"https://mainnet.helius-rpc.com/?api-key={HELIUS_KEY}" if HELIUS_KEY else "https://api.mainnet-beta.solana.com") try: r = requests.post(rpc_url, json={ "jsonrpc": "2.0", "id": 1, "method": "getTokenAccountsByOwner", "params": [wallet, {"programId": "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA"}, {"encoding": "jsonParsed"}] }, headers=HEADERS, timeout=8) if r.status_code == 200: result = r.json().get("result", {}) return result.get("value", []) except Exception: pass return [] def analyze_wallet(wallet: str, tx_limit: int = 100) -> PnLResult: result = PnLResult(wallet=wallet) # Fetch data txns = fetch_helius_transactions(wallet, tx_limit) sol_balance = fetch_sol_balance(wallet) token_accounts = fetch_token_accounts(wallet) ``` ### Technical Analysis The declared functionality requires recent swap history ...[truncated 1828 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:27

Finding

Runtime Execution of an Unpinned npm Package

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: api/server.py:102

Finding

Paid Analysis Can Be Accessed Through an Unauthenticated Free Endpoint

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (54)

Tainted flow: 'FACILITATOR' from os.environ.get (line 26, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The code sends payment data to a facilitator URL fully controlled by the FACILITATOR_URL environment variable, with no allowlist, scheme validation, or authenticity checks. If an attacker can influence deployment configuration, they can redirect verification requests to an arbitrary host, exfiltrate payment tokens/metadata, and potentially spoof successful payment validation responses to bypass billing.

Content

Scanner excerpt · api/server.py (reported line 51)May include surrounding context.

python

if not ph:
        return False
    try:
        r = requests.post(f"{FACILITATOR}/verify",
                          json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]},
                          timeout=10)
        return r.status_code == 200 and r.json().get("isValid", False)

Tainted flow: 'FACILITATOR' from os.environ.get (line 26, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

The settlement call also posts payment data to an environment-controlled external URL without trust validation. A malicious or misconfigured facilitator can receive payment artifacts, return crafted settlement data, or interfere with payment state, creating both data exposure and payment-integrity risks.

Content

Scanner excerpt · api/server.py (reported line 61)May include surrounding context.

python

def settle_payment(ph: str) -> dict:
    try:
        r = requests.post(f"{FACILITATOR}/settle",
                          json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]},
                          timeout=10)
        return r.json() if r.status_code == 200 else {}

Tainted flow: 'rpc_url' from os.environ.get (line 80, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/pnl.py (reported line 66)May include surrounding context.

python

rpc_url = (f"https://mainnet.helius-rpc.com/?api-key={HELIUS_KEY}"
               if HELIUS_KEY else "https://api.mainnet-beta.solana.com")
    try:
        r = requests.post(rpc_url, json={
            "jsonrpc": "2.0", "id": 1, "method": "getBalance", "params": [wallet]
        }, headers=HEADERS, timeout=8)
        if r.status_code == 200:

Tainted flow: 'rpc_url' from os.environ.get (line 80, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/pnl.py (reported line 83)May include surrounding context.

python

rpc_url = (f"https://mainnet.helius-rpc.com/?api-key={HELIUS_KEY}"
               if HELIUS_KEY else "https://api.mainnet-beta.solana.com")
    try:
        r = requests.post(rpc_url, json={
            "jsonrpc": "2.0", "id": 1,
            "method": "getTokenAccountsByOwner",
            "params": [wallet,

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

The file appears to be a tar/PAX header artifact rather than a normal markdown skill file, and it contains embedded NUL/control bytes in extended attribute metadata. While this may be accidental packaging metadata, such bytes can confuse parsers, truncate text, or cause downstream tooling to misread or skip content during security review and skill loading.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear mismatch because the declared description promises a Solana wallet analytics capability, but the provided code chunk contains only file/archive metadata and no executable logic implementing those features. Since no behavior relevant to wallet analysis is visible, the actual supplied content does not substantiate the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a wallet analytics capability focused on Solana trading performance. However, the provided code chunk contains only PaxHeader/archive metadata lines such as mtime and xattr provenance fields. There is no visible logic for blockchain access, wallet parsing, transaction analysis, PnL calculation, or trader evaluation. Because the actual supplied content does not implement the stated purpose and instead appears unrelated metadata, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 81% confidence

Finding

The content shows suspicious nonstandard header/extended-attribute text with binary-looking characters, which is consistent with archive metadata leakage and possible encoding confusion. Even if not overtly malicious, mixed or malformed Unicode/binary content in a text artifact can interfere with review tools, diffing, and security scanners, making hidden content or parser discrepancies more likely.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares capabilities that imply environment-variable access and outbound network use, but it does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader behavior than users or reviewers expect, especially given the skill also references external API usage and a paid request flow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation language is broad enough to trigger on many common wallet or trading-analysis prompts, increasing the chance the skill is invoked without clear user intent. In context, that is more concerning because the skill may make outbound calls and may incur paid usage, so overbroad routing can lead to unintended data disclosure or charges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs sending wallet data to an external paid API but does not require an explicit user warning or confirmation about the outbound transmission and associated cost. This is dangerous because users may unknowingly disclose wallet addresses to a third party and trigger paid requests, which is especially sensitive in a financial-analysis context.

Content

No source excerpt is available for this finding.