pumpfun
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate technical documentation and code examples for interacting with the PumpFun protocol on the Solana blockchain.
- [COMMAND_EXECUTION]: Example scripts such as
add-remove.tsandbuy-sell.tsuse standard Node.js file system modules (fs.readFileSync) to load wallet secret keys from local paths defined by environment variables. This is a common and expected pattern for local developer tools and CLI examples. - [EXTERNAL_DOWNLOADS]: The instructions recommend installing the official protocol SDKs (
@pump-fun/pump-sdkand@pump-fun/pump-swap-sdk) along with standard Solana ecosystem libraries via NPM or PNPM. These are legitimate resources for the skill's stated purpose. - [DATA_EXFILTRATION]: While a specific Solana address is hardcoded as a fee recipient in
examples/bonding-curve/buy-sell.ts, it is used transparently within a technical example for transaction building, which is standard practice in blockchain boilerplate code.
Audit Metadata