compressed-pda

Fail

Audited by Gen Agent Trust Hub on Jun 14, 2026

Risk Level: HIGHDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill explicitly requests access to the user's Solana keypair file at ~/.config/solana/id.json. This file contains the private key for the Solana account used to sign transactions and pay for fees. Accessing this file presents a high risk of credential exposure if the agent environment is compromised.
  • [DATA_EXFILTRATION]: The skill requires an API_KEY (specifically for Helius or Triton RPC services). While necessary for blockchain interaction, this is a sensitive credential that the agent will manage.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install external CLI tools globally using npm install -g @lightprotocol/zk-compression-cli. It also references and potentially downloads code from multiple GitHub repositories under the Lightprotocol organization.
  • [COMMAND_EXECUTION]: The skill executes several powerful shell commands to build and test programs, including anchor build, anchor test, cargo build-sbf, and cargo test-sbf. These commands involve compiling and executing code locally.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jun 14, 2026, 06:53 AM
Security Audit — agent-trust-hub — compressed-pda