compressed-pda
Fail
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: HIGHDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill explicitly requests access to the user's Solana keypair file at
~/.config/solana/id.json. This file contains the private key for the Solana account used to sign transactions and pay for fees. Accessing this file presents a high risk of credential exposure if the agent environment is compromised. - [DATA_EXFILTRATION]: The skill requires an
API_KEY(specifically for Helius or Triton RPC services). While necessary for blockchain interaction, this is a sensitive credential that the agent will manage. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external CLI tools globally using
npm install -g @lightprotocol/zk-compression-cli. It also references and potentially downloads code from multiple GitHub repositories under theLightprotocolorganization. - [COMMAND_EXECUTION]: The skill executes several powerful shell commands to build and test programs, including
anchor build,anchor test,cargo build-sbf, andcargo test-sbf. These commands involve compiling and executing code locally.
Recommendations
- AI detected serious security threats
Audit Metadata