phantom-wallet-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses npx to download the @phantom/mcp-server package from the NPM registry. This represents standard integration with the official Phantom wallet infrastructure.\n- [REMOTE_CODE_EXECUTION]: The skill executes code from the downloaded @phantom/mcp-server package at runtime to perform wallet operations.\n- [COMMAND_EXECUTION]: The environment setup requires the execution of a shell command via npx to launch the MCP server.\n- [DATA_EXFILTRATION]: The skill interacts with sensitive local session data stored at ~/.phantom-mcp/session.json, which is used for persistent authentication between sessions.\n- [INDIRECT_PROMPT_INJECTION]: \n
- Ingestion points: The buy_token tool fetches Solana swap quotes from the external Phantom API, processing dynamic data at runtime.\n
- Boundary markers: The instructions do not define specific delimiters or clear warnings for the agent to ignore instructions embedded in API responses.\n
- Capability inventory: The skill possesses high-impact capabilities including signing transactions, transferring tokens, and signing messages across multiple blockchains.\n
- Sanitization: There is no explicit evidence of sanitization or validation of the contents returned by external API endpoints before they are processed by the agent.
Audit Metadata