Security audit

Maestro Sdk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Solana vault helper, but it asks the agent to initialize wallet credentials, persist financial state, and prompt funding automatically when loaded.

Review before installing. Use this only in an environment where automatic wallet setup, local key access, persistent vault memory, and policy-authorized Solana transfers are acceptable. Require explicit user confirmation for setup and every transfer, pin the SDK version, and avoid placing real private keys in the agent environment unless you have a separate key-management policy.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Wallet Initialization and Unsolicited Cryptocurrency Funding Instructions
Content: View full analysis
I'm your Maestro vault agent. My Solana identity: > > `` > > To connect me: > 1. **Maestro app → + Create Vault** > 2. **Maestro app → Session Keys → + New** → paste: `` > 3. **Maestro app → Top Up** → deposit USDC > 4. Send ~0.05 SOL to `` for gas > > Say **"connect"** when ready. ``` ### Technical Analysis The Skill declares wallet initialization to be automatic and “not optional,” explicitly instructing the Agent not to wait for user input. Loading the Skill can therefore change the Agent’s current-session behavior before the user requests a financial operation. The mandatory flow loads a private key from an environment variable or local file, or generates a new keypair. It then requires the Agent to publish the resulting public key and instruct the us ...[truncated 2113 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:16
Finding: Persistent Trust and Financial State Written into General Agent Memory
Content: View full analysis
- Network: devnet - Status: Waiting for vault ``` **After vault found:** ``` ## Maestro Agent - Pubkey: - Network: devnet - Vault: - Owner: (trusted) - Status: Connected - ALL payments via vault executeTransfer() ``` Log events to `memory/YYYY-MM-DD.md`: connections, transfers (with tx sig), errors. ``` ### Technical Analysis The Skill mandates writes to the Agent’s general `MEMORY.md` and daily memory logs, then requires that state to be loaded at future session startup. The persisted content is not limited to neutral connection metadata: it labels an owner as trusted and embeds the behavioral directive that all payments must use a particular vault method. The Skill states elsewhere that first-connect ownership should be verified with the user. That check reduces risk but does not eliminate it: an incorrect, socially engineered, stale, or compromised trust decision becomes durable and affects future `discoverVaults()` calls through `trustedOwners`. Using general Agent memory also broadens the scope of retained financial information. Vault addresses, owners, transaction signatures, errors, and connection events may remain available to unrelated future interactions or other Skills that can read the same memory. ### Attack Path 1. The Agent discovers one or more vaults associated with its public key. 2. A vault owner is selected and verified incorrectly, ambiguously, or under social engineering. 3. The Skill writes the ...[truncated 1237 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:81
Finding: Unpinned Installation of a Security-Critical Third-Party SDK
Content: View full analysis
Remediation: View remediation
``` 2. Commit and enforce a lockfile so direct and transitive dependency versions are reproducible. 3. Use frozen-lockfile installation in automated environments: ```bash pnpm install --frozen-lockfile ``` 4. Verify package provenance, registry source, checksums, maintainers, and release signatures where available. 5. Review lifecycle scripts and disable them during installation when they are unnecessary. 6. Run wallet-handling code in a restricted process with minimal filesystem, environment-variable, and network access. 7. Establish dependency scanning and a controlled upgrade process that requires security review before changing the pinned version. 8. Keep private keys outside general process environments when possible and use a dedicated signer or hardware-backed key interface. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description mentions transfers, swaps, and vault interaction but does not clearly warn that the skill can execute actions affecting user-controlled funds. For a financial agent, lack of a prominent risk warning and confirmation expectations can lead to unsafe deployment assumptions and accidental fund-moving use.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly instructs persistent reads/writes to local memory files as part of normal operation, which expands its capabilities beyond narrowly operating a vault transaction flow. Persisting pubkeys, owners, trustedOwners, and event logs on disk creates unnecessary local data retention and can leak sensitive operational context or be tampered with by other local processes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill description does not clearly warn that it automatically persists state to local files, even though the instructions mandate ongoing writes to MEMORY.md and event logs. Hidden persistence undermines informed consent and can surprise operators in environments where local storage is sensitive or monitored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description omits that startup behavior accesses environment/local credentials and may generate a new keypair automatically. That omission is particularly dangerous in a financial skill because operators may enable it without realizing it will touch or create signing material on load.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs loading a Solana private key from environment variables or local disk, and generating/storing one locally if absent. Secret handling and key management are highly sensitive capabilities; if implemented naively, they can expose signing keys, enable unauthorized transactions, or create long-lived credentials outside a secure wallet/HSM boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase 'vault questions' is vague and can match ordinary discussion rather than a deliberate request to invoke a high-impact financial skill. In a skill capable of discovering vaults and preparing transaction workflows, ambiguous invocation increases the risk of unintended activation and exposure of operational state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill binds broad categories like money/payment/balance to an execution path that can lead to discoverVaults, health checks, and executeTransfer. Because the skill can affect funds, overbroad triggers without strong intent verification can cause accidental invocation or unsafe action selection from conversational context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The auto-init behavior causes the skill to take action and message the user immediately on load, before any user request or confirmation. That broadens the skill from a passive vault-operation helper into an unsolicited actor, increasing the chance of unintended disclosure of identity details or confusing/unsafe workflow initiation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.