pumpfun-mechanics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/parse_events.pyscript performs network requests to Solana RPC endpoints to retrieve transaction data for analysis. By default, it connects to the official Solana mainnet-beta endpoint, which is a well-known service. This functionality is essential for the skill's stated purpose of parsing on-chain activity. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data retrieved from the blockchain, creating a surface for indirect prompt injection.
- Ingestion points: The
scripts/parse_events.pyfile fetches transaction data from remote Solana RPC providers via thefetch_transactionfunction. - Boundary markers: The skill does not process natural language instructions from the ingested data; instead, it uses rigid binary parsing schemas to extract specific data fields.
- Capability inventory: The skill has network read capabilities (via the
httpxlibrary) and binary parsing capabilities (viastructandbase64). It does not contain capabilities for file system writes, command execution, or dynamic code evaluation. - Sanitization: Ingested data is sanitized through strict validation against expected binary structures using the
structlibrary, which ensures that only correctly formatted data is processed. Exception handlers are used to safely manage malformed or unexpected data inputs.
Audit Metadata