Helius x Phantom

• Outcome: Review
• Latest audit: May 29, 2026 · 9:24 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent with its Solana wallet-development purpose, but it gives agents and copied examples high-impact wallet, payment, signup, and credential-persistence workflows without enough guardrails.

Install only if you are comfortable with a skill that teaches real Solana transaction signing/submission, Helius account signup, paid plan operations, and local credential persistence. Before using it, require explicit user confirmation for any signup, upgrade, renewal, mint, transfer, or message signature; avoid auto-confirm; inspect API-provided transactions before signing; keep API keys and keypairs in restricted local storage; and prefer devnet/test flows while developing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document presents `enableAutoConfirm()` as a normal feature without any warning that it can remove per-transaction user approval for wallet actions. In a frontend wallet-integration guide, this can lead developers to enable automatic approvals broadly, increasing the risk of unintended or malicious transaction execution if the app, dependencies, or session state are compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The document explicitly states that API keys, JWTs, and a private keypair are persisted to shared config and home-directory paths, but it does not warn users about the sensitivity of these credentials, expected file permissions, multi-user machine risks, or safe handling practices. In this context, those artifacts grant access to paid API usage, authenticated account actions, and wallet control, so silent local persistence increases the chance of credential theft or unintended exposure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guidance encourages wallet investigation and attribution lookups that reveal identity, funding source, and transaction intelligence for arbitrary addresses, but it does not include any user-facing privacy, legal, or sensitivity warning. In a frontend/investigation skill, this can normalize deanonymization and profiling workflows without requiring consent, purpose limitation, or disclosure that queried wallet addresses may be sensitive personal or compliance data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The examples guide users through signing and broadcasting Solana mint transactions, but they do not explicitly warn that signing triggers an irreversible on-chain action and network submission. In a wallet-integrated frontend skill, this omission can lead to unsafe UX patterns where users approve transactions without understanding costs, permanence, or destination, increasing the risk of accidental loss or deceptive transaction prompts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The examples demonstrate building, signing, and broadcasting SOL and token transfer transactions without clearly warning that these actions move real funds and submit signed transactions to the network. In a frontend wallet-integration skill, readers may copy these snippets directly, increasing the risk of accidental asset transfers or unsafe reuse in production without adequate user consent UX.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The pre-built transaction example signs opaque API-supplied serialized transactions and immediately forwards them for submission, without advising developers to decode and inspect the instructions first. This is dangerous because a malicious or compromised swap/API backend could craft a transaction that transfers assets, changes authorities, or performs other unintended actions that the user and integrator did not meaningfully verify.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The message-signing example omits that signatures can authorize off-chain actions such as login, wallet ownership proofs, terms acceptance, or replayable attestations depending on backend design. Without a warning, developers may normalize blind signing flows and expose users to phishing or unintended authorization grants.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

import { NetworkId } from "@phantom/browser-sdk";

// Enable for specific chains
await sdk.enableAutoConfirm({
  chains: [NetworkId.SOLANA_MAINNET]
});

• Confidence: 89% confidence
• Finding: AutoConfirm

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

});

// Enable for all supported chains
await sdk.enableAutoConfirm();

// Disable
await sdk.disableAutoConfirm();

• Confidence: 95% confidence
• Finding: AutoConfirm

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/helius-onboarding.md:95