ClawHub
Back to skill

Security audit

Helius x DFlow

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Solana trading development, but it asks users to install mutable external tooling and provides under-scoped guidance for real payments, key storage, KYC, and transaction signing.

Review before installing. Use a pinned, trusted Helius MCP version, restrict where it can read/write, avoid storing wallet keys or JWTs on shared machines, require explicit human approval before any signup, renewal, upgrade, or transaction signing, validate DFlow transaction instructions before signing, and prefer HTTPS plus backend-secret handling for API keys and KYC flows.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
references/integration-patterns.md:15
Finding

Externally Supplied Transactions Are Signed Without Documented Instruction Validation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/helius-wallet-api.md:130
Finding

API Keys Are Embedded in Request URLs

Content
View full analysis
r.ok ? r.json() : null); const funding = await fetch(`${BASE}/v1/wallet/${address}/funded-by?api-key=${KEY}`).then(r => r.ok ? r.json() : null); const { data: history } = await fetch(`${BASE}/v1/wallet/${address}/history?api-key=${KEY}&limit=20`).then(r => r.json()); ``` The same pattern appears in: - `references/integration-patterns.md`, line 237: ```typescript const response = await fetch(`https://mainnet.helius-rpc.com/?api-key=${HELIUS_API_KEY}`, { ``` - `references/helius-priority-fees.md`, lines 30 and 53: ```typescript const response = await fetch(`https://mainnet.helius-rpc.com/?api-key=${API_KEY}`, { ``` ### Technical Analysis Query-string credentials commonly propagate beyond the component that constructs the request. Depending on deployment and logging configuration, the complete URL may be recorded in: - Browser history and developer tooling. - Reverse-proxy and load-balancer access logs. - CDN, WAF, observability, and APM systems. - Exception reports and application diagnostics. - Network monitoring products. - Screenshots, copied URLs, or support bundles. The integration reference explicitly states that Helius RPC and DAS may be called directly from a browser. A browser application cannot safely retain a long-lived service API key: users, browser extensions, injected scripts, and anyone with developer-tool access can extract it. This exceeds least privilege because a client receives a reusable project credential when it only needs access to a narrow operation. Sending the key to the intended Helius endpoint is necessary for authenticated API access, but ex ...[truncated 1022 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/helius-sender.md:80
Finding

Backend Sender Guidance Uses Unencrypted HTTP for Signed Transaction Submission

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:34
Finding

Recommended MCP Installation Executes an Unpinned Package Through npx

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/integration-patterns.md:151
Finding

DFlow Proxy Example Exposes Unauthenticated Pass-Through Endpoints Without Validation or Rate Limits

Content
View full analysis
{ const params = new URLSearchParams(req.query as Record); const response = await fetch(`${DFLOW_API}/order?${params}`); const data = await response.json(); res.json(data); }); app.get('/api/dflow/intent', async (req, res) => { const params = new URLSearchParams(req.query as Record); const response = await fetch(`${DFLOW_API}/intent?${params}`); const data = await response.json(); res.json(data); }); app.post('/api/dflow/submit-intent', async (req, res) => { const response = await fetch(`${DFLOW_API}/submit-intent`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(req.body), }); const data = await response.json(); res.json(data); }); app.get('/api/dflow/order-status', async (req, res) => { const params = new URLSearchParams(req.query as Record); const response = await fetch(`${DFLOW_API}/order-status?${params}`); const data = await response.json(); res.json(data); }); app.listen(3001); ``` ### Technical Analysis The proxy has no authentication, authorization, request schema, parameter allowlist, body-size restriction beyond framework defaults, rate limiting, timeout, upstream status handling, or abuse controls. If deployed on a public interface, any remote party can use the application as a DFlow relay. Because the upstream origin is fixed by `DFLOW_API`, this is not a general-purpos ...[truncated 1500 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/dflow-proof-kyc.md:69
Finding

KYC Wallet Signatures Are Placed in Browser Query Strings Without Replay-Binding Guidance

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill covers wallet intelligence, holdings, history, and Proof KYC flows but does not prominently warn that these are privacy-sensitive operations or instruct the agent to minimize collection, retention, and display of personal data. In a trading and identity context, exposing wallet history or KYC state without explicit consent can create privacy harm, profiling risk, or improper handling of regulated identity information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to install an MCP server via npx helius-mcp@latest, which is an unpinned dependency and can change over time without review. If the upstream package is compromised or a breaking/malicious release is published, users could install and execute unintended code in a privileged local environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The quick-disambiguation section lists very short everyday phrases such as "trade", "swap", "setup", and "submit" as intents that route into this skill. While domain-relevant, these phrases are broad and the file does not provide negative examples or explicit boundaries to prevent accidental activation in adjacent contexts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This is the same supply-chain risk repeated in the resources section: users are directed to run npx helius-mcp@latest, which fetches and executes the newest package version at install time. In an agent/tooling context, that creates a real avenue for malicious package updates or accidental insecure changes to be introduced downstream.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 7)May include surrounding context.

sh
SKILL_NAME="helius-dflow"
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"

# Default: install to personal skills
TARGET_BASE="$HOME/.claude/skills"
MODE="personal"

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installer instructs users to add an MCP server via npx helius-mcp@latest, which pulls and executes the newest published package version at install/use time rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised, typosquatted, or a bad release is published, users may execute untrusted code in their local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The skill describes previewUpgrade, upgradePlan, and payRenewal as routine actions without an explicit caution that they trigger real USDC payments and may have immediate billing effects. In an agentic workflow, that omission is dangerous because users or downstream agents may treat these calls as informational rather than state-changing, leading to unintended charges or unauthorized plan changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document states that API keys, JWTs, and keypairs are persisted to shared config and local files, but it does not prominently warn users about the security implications of local credential storage. In this context, the stored materials can grant ongoing access to Helius services, billing visibility, authenticated sessions, and wallet-based signup flows, so silent persistence increases the risk of credential theft, accidental sharing, or reuse on multi-user systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The install command uses npx helius-mcp@latest, which fetches and executes whatever package version is current at runtime. This creates a supply-chain risk: a compromised upstream package, malicious update, or unexpected breaking change could be executed immediately on the user's machine, and in this skill context the package would likely handle API keys, JWTs, and payment-capable workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The guidance mandates skipPreflight: true and adds a required Jito tip transfer, but it does not clearly warn users that this bypasses client-side safety checks and can submit irreversible on-chain transactions that also transfer extra funds. In a trading skill, that omission is risky because integrators may copy the pattern directly and unknowingly expose users to failed or unintended transactions with real monetary loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/helius-sender.md (reported line 193)May include surrounding context.

md
transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/helius-sender.md (reported line 355)May include surrounding context.

md
transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/helius-sender.md (reported line 273)May include surrounding context.

md
const signedTx = await signTransactionMessageWithSigners(tx);
  const base64Tx = getBase64EncodedWireTransaction(signedTx);

  const res = await fetch("https://sender.helius-rpc.com/fast", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/helius-wallet-api.md (reported line 17)May include surrounding context.

md
## MCP Tools

All Wallet API endpoints have direct MCP tools. ALWAYS use these instead of generating raw API calls:

| MCP Tool | Endpoint | What It Does |
|---|---|---|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file instructs the agent to investigate wallets using identity, balance, history, transfer, and funding-source tools, which can affect user privacy and attribution. The document does not include any warning or caution to users that these actions may reveal sensitive intelligence about individuals or entities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The section provides concrete instructions for building an automated trading bot that reacts to live price signals and submits real transactions, but it does not include a clear warning that these actions can spend user funds and execute irreversible trades on mainnet. In a trading-focused skill, omission of this warning increases the chance that users deploy or adapt the example against live wallets without adequate safeguards, leading to unintended financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents calls like getAssetsByOwner with ownerAddress and display options that reveal SOL balance, fungible holdings, and collection metadata, but it does not warn users that these requests disclose wallet-associated portfolio data to an external service. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The document recommends a background setInterval ping loop but does not warn that it creates ongoing network traffic during idle periods. This can surprise users, increase observability/privacy exposure, and cause unnecessary resource consumption in client or server environments.

Content

No source excerpt is available for this finding.