solana-payments-wallets-trading
Warn
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The documentation instructs the agent to execute code directly from the npm registry using 'npx @solana-compass/cli@latest'. This involves a remote execution pattern from a source not recognized as a trusted vendor.
- [COMMAND_EXECUTION]: The skill facilitates sensitive financial transactions and system configuration via shell commands. Notably, the 'sol portfolio cron' command in 'references/portfolio-commands.md' generates crontab entries, establishing a pattern for scheduled persistence on the host system.
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection (Category 8). Ingestion points: Untrusted data enters the agent context via 'sol fetch' in 'references/fetch-commands.md' and 'token browse' in 'references/trading-commands.md'. Boundary markers: There are no instructions to the agent to ignore or delimit embedded instructions in the fetched data. Capability inventory: The skill provides extensive high-privilege capabilities including 'token send', 'swap', and 'stake new' documented in 'references/trading-commands.md' and 'references/staking-commands.md'. Sanitization: No sanitization of the external content is performed before processing.
- [DATA_EXFILTRATION]: The 'sol fetch' command enables automated payments to external URLs via the x402 protocol. If security limits and allowlists are not strictly enforced, this could be exploited by a malicious actor to trick an agent into exfiltrating USDC or other assets.
Audit Metadata