技能 soulboard
📦

soulboard

v1.0.0 內容修訂 r1 高風險 ⚙️ 外部命令🌐 網路存取🔑 環境變數

Manage SoulBoard Tokens With Your Agentic Wallet

SoulBoard actions require backend preparation and wallet signing across separate tools. This skill connects token browsing, transaction preparation, and Binance agentic wallet workflows.

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理,其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "soulboard" from https://skillstore.io/skills/soulboardfun-soulboard.md and its manifest at https://skillstore.io/api/skills/soulboardfun-soulboard/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫,並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時,請使用這些連結。

測試它

正在使用「soulboard」。 Check whether my wallet can mint this token.

預期結果:

  • Example result: The backend refused mint preparation because the wallet has no Agent-ID on BNB Chain.
  • Claim the required Agent-ID in the Binance app before retrying.
  • No transaction was signed.

正在使用「soulboard」。 Prepare a sale and stop before signing.

預期結果:

  • Example result: Sale preparation returned approval and listing steps.
  • Review the approval spender, allowance, token amount, and listing price before signing.
  • Preparation does not publish a listing; wallet execution is still required.

正在使用「soulboard」。 What must I review before launching?

預期結果:

  • Check whole-token supply, tokens per mint, mint price, creator fees, and wallet limits.
  • The documented launch burns 1,000 BOARD and requires network gas.
  • Inspect decoded approval and launch transactions before authorizing either step.

安全審計

高風險
v1 • 2026/10/29 開啟版本化報告

Most static findings are formatting matches, documented API traffic, or protective guidance; no evidence of credential theft or prompt injection was found. The documented plaintext backend permits response tampering, although both scripts default to HTTPS. The CLI trusts backend transaction payloads without action validation and omits decoded transaction details, with an option to skip confirmation.

3
已掃描檔案
488
分析行數
2
複核項目
0
已忽略的誤報

已確認的安全問題 (1)

高
Backend Transactions Can Execute Without Meaningful Action Verification
Mint and launch responses supply transaction targets, calldata, and values without local checks against the requested action. Confirmation shows value and risks, omits parsedTx and target details, and can be skipped with --yes. A compromised backend could substitute a transfer or approval and obtain wallet execution without meaningful review.
The CLI directly forwards backend transaction fields and never displays parsedTx, despite the documented requirement. The --yes flag demonstrably bypasses the confirmation branch; exploitation requires a substituted backend response.
能力複核項目 (2)

這些是真實的本機能力,對此技能而言可能是預期行為,因此需要複核,但不會按已確認的惡意行為計分。

中
Hardcoded URL
Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat
The documented backend uses plaintext HTTP for action preparation. A network attacker could alter transaction targets, calldata, or values before wallet signing.
中
Hardcoded IP address
Set `SOULBOARD_BACKEND` (default `http://5.223.72.216:8248`). All on-chain state and action-preparat
The hardcoded IP is advertised as a plaintext HTTP backend for transaction preparation. This lacks authenticated transport and differs from the scripts' HTTPS defaults.
審計單位: codex
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據,不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/soulboardfun-soulboard/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg)](https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/soulboardfun-soulboard?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/soulboardfun-soulboard/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/soulboardfun-soulboard.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

soulboardfun. (2026). soulboard security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/soulboardfun-soulboard/audits/1

BibTeX 引用

@techreport{soulboardfun-soulboardfun-soulboard-2026, author = {soulboardfun}, title = {soulboard security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/soulboardfun-soulboard/audits/1}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "soulboard security audit report (audit version 1)" version: "1.0.0" type: report authors: - name: "soulboardfun" date-released: "2026-10-29" url: "https://skillstore.io/skills/soulboardfun-soulboard/audits/1" identifiers: - type: other value: "skillstore:soulboardfun-soulboard:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
45
架構
100
可維護性
87
內容
65
社群
91
規範符合度

你可以打造什麼

Inspect Available Tokens

Retrieve token details and board data without preparing or signing a transaction.

Prepare a Fair-Mint Launch

Set supply, mint allocation, price, metadata, and wallet limits before reviewing approval and launch transactions.

Prepare Wallet Market Actions

Use MCP tools to prepare listings, purchases, cancellations, or transfers for separate wallet review.

試試這些提示

Browse the Board
Show the current SoulBoard board with token names, symbols, and available mint information. Do not prepare or sign transactions.
Check Mint Eligibility
Check mint eligibility for [token address] using my public wallet address. Report backend errors and required setup without signing anything.
Review a Sale Listing
Prepare selling [amount] of [token address] at [price in wei]. Show approval spender, allowance, target, value, and decoded details before requesting confirmation.
Plan a Restricted Token Launch
Prepare a launch for [symbol] with [supply] whole tokens, [tokens per mint], and [price in ETH]. Review targets, approvals, fees, and limits before signing. After deployment, prepare a creator-signed whitelist from [address list] and request confirmation separately.

最佳實務

  • Use a verified HTTPS backend; configure the CLI with --backend and MCP with SOULBOARD_BACKEND.
  • Independently verify decoded targets, approvals, amounts, and risks before each signature; keep automatic confirmation disabled.
  • Confirm token units, wei amounts, Agent-ID eligibility, and gas balance before preparing transactions.

避免

  • Sending private keys or seed phrases to the assistant or backend.
  • Treating a prepared transaction as validated, signed, or successfully confirmed.
  • Using plaintext backends or automatic confirmation for transactions involving funds.

常見問題

Does this skill store private keys?
The provided scripts do not read private keys. Signing is delegated to the separate Binance agentic wallet.
What setup is required?
Use Python 3, a configured Binance agentic wallet, Developer Mode for contract calls, an Agent-ID for gated actions, and network gas. MCP also requires the mcp package.
Does every MCP tool execute a transaction?
No. Read tools retrieve data, and preparation tools return transaction payloads. A separate wallet must review and sign those payloads.
Which network and units are used?
The default network is Robinhood Chain, chain ID 4663. Launch supply uses whole tokens; MCP prices use wei, while CLI launch prices use ETH.
How do I choose the backend?
Both scripts default to https://soulboard.fun. Set --backend for the CLI or SOULBOARD_BACKEND for MCP. Avoid the plaintext endpoint in the documentation.
Are prepared transactions independently validated?
No. The CLI forwards backend transaction fields without checking the intended action and omits decoded details from confirmation. Independently review before signing.

開發者詳細資訊

授權

MIT

作者版本

v1.0.0

Skillstore 修訂

r1

引用

01849f636f1410e4fc9287f62c7c9cd1700c583e

維護新鮮度

2026/10/29

使用量

0 次下載 · 0 次瀏覽

檔案結構

查看全部