pumpfun-mechanics

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The scripts/parse_events.py script performs network requests to Solana RPC endpoints to retrieve transaction data for analysis. By default, it connects to the official Solana mainnet-beta endpoint, which is a well-known service. This functionality is essential for the skill's stated purpose of parsing on-chain activity.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from the blockchain, creating a surface for indirect prompt injection.
  • Ingestion points: The scripts/parse_events.py file fetches transaction data from remote Solana RPC providers via the fetch_transaction function.
  • Boundary markers: The skill does not process natural language instructions from the ingested data; instead, it uses rigid binary parsing schemas to extract specific data fields.
  • Capability inventory: The skill has network read capabilities (via the httpx library) and binary parsing capabilities (via struct and base64). It does not contain capabilities for file system writes, command execution, or dynamic code evaluation.
  • Sanitization: Ingested data is sanitized through strict validation against expected binary structures using the struct library, which ensures that only correctly formatted data is processed. Exception handlers are used to safely manage malformed or unexpected data inputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 07:54 PM