solana-agent-kit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs point to an unvetted GitHub repo and a direct raw.githubusercontent shell install script (install.sh) — downloading/executing an unknown install script or code from a small/unknown repo is a high-risk malware vector.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Vercel AI SDK integration, the runtime POST /api/chat route ingests the caller-supplied JSON messages (free text) into streamText({ messages }), which the model then uses to select and call Solana tools.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The MCP server README instructs users to fetch and execute remote installation code (curl -fsSL https://raw.githubusercontent.com/sendaifun/solana-mcp/main/scripts/install.sh ...) and to clone/build the repository (git clone https://github.com/sendaifun/solana-mcp), which pulls and runs external code during setup.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The SKILL explicitly exposes crypto financial operations: token deployment, SOL/SPL transfers, swaps/trades (Jupiter), staking, bridging, airdrops, limit/perpetual orders, and autonomous execution (agent.execute). It also shows private-key usage and embedded wallet integrations (Turnkey/Privy) and lists MCP tools like TRANSFER and TRADE. These are specific blockchain transaction and wallet capabilities (signing/sending funds), which constitute direct financial execution authority.