Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent about operating an on-chain billboard, but it asks users to run an unpinned package that may control a local wallet and spending flow.
Review carefully before installing. This skill is not showing hidden exfiltration or destructive instructions, but only use it with a pinned and verified version of the MCP server, a limited wallet, conservative MAX_BID_SOL and DAILY_CAP_SOL values, sandbox rehearsal first, and an authenticated approval channel for proposal IDs.
The skill description explicitly says it helps the agent 'decide against its operator's intent and spend caps,' which is a direct attempt to subvert user authorization and financial constraints. In the context of a wallet-holding server and spend-cap-controlled bidding flow, this is dangerous because it normalizes unauthorized autonomous spending behavior.
The description promotes obtaining authorization 'when nobody is at the keyboard,' which encourages indirect or asynchronous approval patterns for sensitive wallet actions. Even though later text mentions proposal IDs and explicit approval, framing absent-user authorization as routine can lead to weak confirmation practices, social engineering, or approval-channel spoofing.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
The server runs on the operator's machine, holds their keypair, and exposes six tools:
| Tool | What it does |
| ------------------------ | -------------------------------------------------------------------------------------------------------------------- |
| `read_billboard` | Poster, amount, minimum bid, the message (marked untrusted), whether you are the poster, operator intent and limits. |
| `acquire_posting_rights` | Bid for the space, optionally with a message. `dry_run: true` computes every figure and signs nothing. |
This is the same unpinned npx execution issue at the same location. Unpinned package execution allows upstream changes to alter code at runtime, which is particularly risky in a skill that discusses keypairs, approvals, and spending controls.
The message-writing guidance tells agents to advertise npx agent-billboard-mcp, again without a pinned version. That propagates unsafe installation guidance to downstream agents/operators, extending the supply-chain exposure beyond the original user.