📦

soulboard

Name: soulboard
Author: soulboardfun

v1.0.0 Ревизия содержимого r1 Высокий риск ⚙️ Внешние команды🌐 Доступ к сети🔑 Переменные окружения

Manage SoulBoard Tokens With Your Agentic Wallet

SoulBoard actions require backend preparation and wallet signing across separate tools. This skill connects token browsing, transaction preparation, and Binance agentic wallet workflows.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Остановитесь и запросите подтверждение перед установкой.

Проверьте план и получите явное согласие пользователя перед изменением файлов.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "soulboard" from https://skillstore.io/skills/soulboardfun-soulboard.md and its manifest at https://skillstore.io/api/skills/soulboardfun-soulboard/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/soulboardfun-soulboard.md Подписанный manifest GET /api/skills/soulboardfun-soulboard/manifest Подписанный lockfile GET /api/skills/soulboardfun-soulboard/lockfile

Протестировать

Использование «soulboard». Check whether my wallet can mint this token.

Ожидаемый результат:

Example result: The backend refused mint preparation because the wallet has no Agent-ID on BNB Chain.
Claim the required Agent-ID in the Binance app before retrying.
No transaction was signed.

Использование «soulboard». Prepare a sale and stop before signing.

Ожидаемый результат:

Example result: Sale preparation returned approval and listing steps.
Review the approval spender, allowance, token amount, and listing price before signing.
Preparation does not publish a listing; wallet execution is still required.

Использование «soulboard». What must I review before launching?

Ожидаемый результат:

Check whole-token supply, tokens per mint, mint price, creator fees, and wallet limits.
The documented launch burns 1,000 BOARD and requires network gas.
Inspect decoded approval and launch transactions before authorizing either step.

Аудит безопасности

Высокий риск

v1 • 29.10.2026 Открыть версионный отчет

Most static findings are formatting matches, documented API traffic, or protective guidance; no evidence of credential theft or prompt injection was found. The documented plaintext backend permits response tampering, although both scripts default to HTTPS. The CLI trusts backend transaction payloads without action validation and omits decoded transaction details, with an option to skip confirmation.

Просканировано файлов

488

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Высокий

scripts/soulboard:112-126 scripts/soulboard:148-149 scripts/soulboard:184-186 scripts/soulboard:208-212 SKILL.md:94

Backend Transactions Can Execute Without Meaningful Action Verification

Mint and launch responses supply transaction targets, calldata, and values without local checks against the requested action. Confirmation shows value and risks, omits parsedTx and target details, and can be skipped with --yes. A compromised backend could substitute a transfer or approval and obtain wallet execution without meaningful review.

The CLI directly forwards backend transaction fields and never displays parsedTx, despite the documented requirement. The --yes flag demonstrably bypasses the confirmation branch; exploitation requires a substituted backend response.

Пункты проверки возможностей (2)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

SKILL.md:25

Hardcoded URL

Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat

The documented backend uses plaintext HTTP for action preparation. A network attacker could alter transaction targets, calldata, or values before wallet signing.

Средний

SKILL.md:25

Hardcoded IP address

Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat

The hardcoded IP is advertised as a plaintext HTTP backend for transaction preparation. This lacks authenticated transport and differs from the scripts' HTTPS defaults.

Факторы риска

⚙️ Внешние команды (49)

🌐 Доступ к сети (17)

scripts/soulboard:35 scripts/soulboard:67 scripts/soulboard:71 scripts/soulboard:101 scripts/soulboard:104 scripts/soulboard:22 scripts/soulboard:38 scripts/soulboard_mcp.py:14 scripts/soulboard_mcp.py:23 scripts/soulboard_mcp.py:24 scripts/soulboard_mcp.py:28 scripts/soulboard_mcp.py:32 scripts/soulboard_mcp.py:8 scripts/soulboard_mcp.py:18 SKILL.md:25 SKILL.md:57 SKILL.md:25

🔑 Переменные окружения (1)

scripts/soulboard_mcp.py:18

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/soulboardfun-soulboard/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg)](https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/soulboardfun-soulboard.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

soulboardfun. (2026). soulboard security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/soulboardfun-soulboard/audits/1

Цитата BibTeX

@techreport{soulboardfun-soulboardfun-soulboard-2026,
  author = {soulboardfun},
  title = {soulboard security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/soulboardfun-soulboard/audits/1},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "soulboard security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
  - name: "soulboardfun"
date-released: "2026-10-29"
url: "https://skillstore.io/skills/soulboardfun-soulboard/audits/1"
identifiers:
  - type: other
    value: "skillstore:soulboardfun-soulboard:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

100

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Inspect Available Tokens

Retrieve token details and board data without preparing or signing a transaction.

Prepare a Fair-Mint Launch

Set supply, mint allocation, price, metadata, and wallet limits before reviewing approval and launch transactions.

Prepare Wallet Market Actions

Use MCP tools to prepare listings, purchases, cancellations, or transfers for separate wallet review.

Попробуйте эти промпты

Browse the Board

Show the current SoulBoard board with token names, symbols, and available mint information. Do not prepare or sign transactions.

Check Mint Eligibility

Check mint eligibility for [token address] using my public wallet address. Report backend errors and required setup without signing anything.

Review a Sale Listing

Prepare selling [amount] of [token address] at [price in wei]. Show approval spender, allowance, target, value, and decoded details before requesting confirmation.

Plan a Restricted Token Launch

Prepare a launch for [symbol] with [supply] whole tokens, [tokens per mint], and [price in ETH]. Review targets, approvals, fees, and limits before signing. After deployment, prepare a creator-signed whitelist from [address list] and request confirmation separately.

Лучшие практики

Use a verified HTTPS backend; configure the CLI with --backend and MCP with SOULBOARD_BACKEND.
Independently verify decoded targets, approvals, amounts, and risks before each signature; keep automatic confirmation disabled.
Confirm token units, wei amounts, Agent-ID eligibility, and gas balance before preparing transactions.

Избегать

Sending private keys or seed phrases to the assistant or backend.
Treating a prepared transaction as validated, signed, or successfully confirmed.
Using plaintext backends or automatic confirmation for transactions involving funds.

Часто задаваемые вопросы

Does this skill store private keys?

The provided scripts do not read private keys. Signing is delegated to the separate Binance agentic wallet.

What setup is required?

Use Python 3, a configured Binance agentic wallet, Developer Mode for contract calls, an Agent-ID for gated actions, and network gas. MCP also requires the mcp package.

Does every MCP tool execute a transaction?

No. Read tools retrieve data, and preparation tools return transaction payloads. A separate wallet must review and sign those payloads.

Which network and units are used?

The default network is Robinhood Chain, chain ID 4663. Launch supply uses whole tokens; MCP prices use wei, while CLI launch prices use ETH.

How do I choose the backend?

Both scripts default to https://soulboard.fun. Set --backend for the CLI or SOULBOARD_BACKEND for MCP. Avoid the plaintext endpoint in the documentation.

Are prepared transactions independently validated?

No. The CLI forwards backend transaction fields without checking the intended action and omits decoded details from confirmation. Independently review before signing.