📦

soulboard

Name: soulboard
Author: soulboardfun

v1.0.0 コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド🌐 ネットワークアクセス🔑 環境変数

Manage SoulBoard Tokens With Your Agentic Wallet

SoulBoard actions require backend preparation and wallet signing across separate tools. This skill connects token browsing, transaction preparation, and Binance agentic wallet workflows.

対応: Claude Codex Code(CC)

⚠️ 38 不十分

Maintain this Skill? Claim it ⚠️ 38 不十分

インストール前に停止して確認を求めてください。

計画を確認し、ファイルを変更する前にユーザーの明示的な同意を得てください。

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "soulboard" from https://skillstore.io/skills/soulboardfun-soulboard.md and its manifest at https://skillstore.io/api/skills/soulboardfun-soulboard/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/soulboardfun-soulboard.md 署名済み manifest GET /api/skills/soulboardfun-soulboard/manifest 署名済み lockfile GET /api/skills/soulboardfun-soulboard/lockfile

テストする

「soulboard」を使用しています。 Check whether my wallet can mint this token.

期待される結果:

Example result: The backend refused mint preparation because the wallet has no Agent-ID on BNB Chain.
Claim the required Agent-ID in the Binance app before retrying.
No transaction was signed.

「soulboard」を使用しています。 Prepare a sale and stop before signing.

期待される結果:

Example result: Sale preparation returned approval and listing steps.
Review the approval spender, allowance, token amount, and listing price before signing.
Preparation does not publish a listing; wallet execution is still required.

「soulboard」を使用しています。 What must I review before launching?

期待される結果:

Check whole-token supply, tokens per mint, mint price, creator fees, and wallet limits.
The documented launch burns 1,000 BOARD and requires network gas.
Inspect decoded approval and launch transactions before authorizing either step.

セキュリティ監査

高リスク

v1 • 2026/10/29 バージョン別レポートを開く

Most static findings are formatting matches, documented API traffic, or protective guidance; no evidence of credential theft or prompt injection was found. The documented plaintext backend permits response tampering, although both scripts default to HTTPS. The CLI trusts backend transaction payloads without action validation and omits decoded transaction details, with an option to skip confirmation.

スキャンされたファイル

488

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

高

scripts/soulboard:112-126 scripts/soulboard:148-149 scripts/soulboard:184-186 scripts/soulboard:208-212 SKILL.md:94

Backend Transactions Can Execute Without Meaningful Action Verification

Mint and launch responses supply transaction targets, calldata, and values without local checks against the requested action. Confirmation shows value and risks, omits parsedTx and target details, and can be skipped with --yes. A compromised backend could substitute a transfer or approval and obtain wallet execution without meaningful review.

The CLI directly forwards backend transaction fields and never displays parsedTx, despite the documented requirement. The --yes flag demonstrably bypasses the confirmation branch; exploitation requires a substituted backend response.

機能レビュー項目 (2)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中

SKILL.md:25

Hardcoded URL

Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat

The documented backend uses plaintext HTTP for action preparation. A network attacker could alter transaction targets, calldata, or values before wallet signing.

中

SKILL.md:25

Hardcoded IP address

Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat

The hardcoded IP is advertised as a plaintext HTTP backend for transaction preparation. This lacks authenticated transport and differs from the scripts' HTTPS defaults.

リスク要因

⚙️ 外部コマンド (49)

🌐 ネットワークアクセス (17)

scripts/soulboard:35 scripts/soulboard:67 scripts/soulboard:71 scripts/soulboard:101 scripts/soulboard:104 scripts/soulboard:22 scripts/soulboard:38 scripts/soulboard_mcp.py:14 scripts/soulboard_mcp.py:23 scripts/soulboard_mcp.py:24 scripts/soulboard_mcp.py:28 scripts/soulboard_mcp.py:32 scripts/soulboard_mcp.py:8 scripts/soulboard_mcp.py:18 SKILL.md:25 SKILL.md:57 SKILL.md:25

🔑 環境変数 (1)

scripts/soulboard_mcp.py:18

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/soulboardfun-soulboard/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg)](https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/soulboardfun-soulboard.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

soulboardfun. (2026). soulboard security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/soulboardfun-soulboard/audits/1

BibTeX形式の引用

@techreport{soulboardfun-soulboardfun-soulboard-2026,
  author = {soulboardfun},
  title = {soulboard security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/soulboardfun-soulboard/audits/1},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "soulboard security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
  - name: "soulboardfun"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/soulboardfun-soulboard/audits/1"
identifiers:
  - type: other
    value: "skillstore:soulboardfun-soulboard:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

100

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Inspect Available Tokens

Retrieve token details and board data without preparing or signing a transaction.

Prepare a Fair-Mint Launch

Set supply, mint allocation, price, metadata, and wallet limits before reviewing approval and launch transactions.

Prepare Wallet Market Actions

Use MCP tools to prepare listings, purchases, cancellations, or transfers for separate wallet review.

これらのプロンプトを試す

Browse the Board

Show the current SoulBoard board with token names, symbols, and available mint information. Do not prepare or sign transactions.

Check Mint Eligibility

Check mint eligibility for [token address] using my public wallet address. Report backend errors and required setup without signing anything.

Review a Sale Listing

Prepare selling [amount] of [token address] at [price in wei]. Show approval spender, allowance, target, value, and decoded details before requesting confirmation.

Plan a Restricted Token Launch

Prepare a launch for [symbol] with [supply] whole tokens, [tokens per mint], and [price in ETH]. Review targets, approvals, fees, and limits before signing. After deployment, prepare a creator-signed whitelist from [address list] and request confirmation separately.

ベストプラクティス

Use a verified HTTPS backend; configure the CLI with --backend and MCP with SOULBOARD_BACKEND.
Independently verify decoded targets, approvals, amounts, and risks before each signature; keep automatic confirmation disabled.
Confirm token units, wei amounts, Agent-ID eligibility, and gas balance before preparing transactions.

回避

Sending private keys or seed phrases to the assistant or backend.
Treating a prepared transaction as validated, signed, or successfully confirmed.
Using plaintext backends or automatic confirmation for transactions involving funds.

よくある質問

Does this skill store private keys?

The provided scripts do not read private keys. Signing is delegated to the separate Binance agentic wallet.

What setup is required?

Use Python 3, a configured Binance agentic wallet, Developer Mode for contract calls, an Agent-ID for gated actions, and network gas. MCP also requires the mcp package.

Does every MCP tool execute a transaction?

No. Read tools retrieve data, and preparation tools return transaction payloads. A separate wallet must review and sign those payloads.

Which network and units are used?

The default network is Robinhood Chain, chain ID 4663. Launch supply uses whole tokens; MCP prices use wei, while CLI launch prices use ETH.

How do I choose the backend?

Both scripts default to https://soulboard.fun. Set --backend for the CLI or SOULBOARD_BACKEND for MCP. Avoid the plaintext endpoint in the documentation.

Are prepared transactions independently validated?

No. The CLI forwards backend transaction fields without checking the intended action and omits decoded details from confirmation. Independently review before signing.