ClawHub
Back to skill

Security audit

Helius

Security checks for vulnerabilities and agentic risk

Overview

This Solana developer skill appears purpose-aligned, but it gives agents access to payments, persisted credentials, and transaction submission while relying on mutable npm installs and under-disclosed safety tradeoffs.

Review this skill before installing in any wallet, production, or billing context. Pin and verify the Helius MCP/CLI packages instead of using @latest, keep funded signup wallets at the minimum balance, require explicit confirmation before payments, upgrades, renewals, tips, or transaction signing, prefer HTTPS endpoints, authenticate webhook receivers, and protect or rotate any API keys, JWTs, and keypair files it creates.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:18
Finding

Mutable npm Packages Are Executed Through Unpinned npx Commands

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/sender.md:82
Finding

Signed Transactions May Be Submitted Over Unencrypted HTTP

Content
View full analysis
{ try { await fetch(`${endpoint}/ping`); } catch { // Ignore ping failures } }, 30_000); ``` ```markdown Ping endpoints: - HTTPS: `https://sender.helius-rpc.com/ping` - Regional: `http://{region}-sender.helius-rpc.com/ping` (slc, ewr, lon, fra, ams, sg, tyo) ``` ### Technical Analysis HTTP does not provide transport confidentiality, server authentication, or transport-level integrity. The Sender request body contains a signed, serialized transaction. The transaction does not contain the signer's private key, and its cryptographic signature prevents an intermediary from silently changing signed instructions without invalidating the signature. Nevertheless, an on-path attacker can: - Read the complete transaction before it lands on-chain. - Submit the observed transaction through another endpoint before the original request. - Drop or delay the request. - Forge an HTTP response to mislead the application. - Observe a Sender API key if a key is appended to an HTTP URL. - Analyze time- ...[truncated 1397 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/webhooks.md:163
Finding

Webhook Receiver Template Processes Unauthenticated Events

Content
View full analysis
{ for (const event of req.body) { if (processed.has(event.signature)) continue; processed.add(event.signature); // Route by event.type — access event.nativeTransfers, event.tokenTransfers, event.description } res.status(200).send('OK'); }); ``` The document later acknowledges the issue, but the secure control is not implemented in the primary template: ```markdown - Exposing webhook endpoint without authentication — add a shared secret or signature verification in production ``` ### Technical Analysis The handler trusts every HTTP client able to reach `/webhook`. Deduplication by `event.signature` only prevents repeated processing of the same supplied value; it does not prove that the event came from Helius or that the signature corresponds to the described on-chain transaction. An attacker can create a unique fake signature for every request and supply arbitrary values in fields such as: - `type` - `description` - `nativeTransfers` - `tokenTransfers` - `feePayer` - `transactionError` If downstream logic sends notifications, updates accounting records, credits users, or triggers automation based on these values, forged requests can produce unauthorized actions. ### Attack Path 1. A developer copies the documented receiver into a public application. 2. The webhook endpoint becomes reachable from the internet. 3. An attacker sends a crafted POST body containing a fake transfer, swap, sale, or governance event. 4. The attacker chooses a fresh `signature` value to bypass the deduplication set. 5. The handler processes the event without authenticating its source or independently validating it on-chain. 6. Downstream business logic acts on attacker-controlled event data. ### Impact Assessment The dire ...[truncated 535 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
references/priority-fees.md:30
Finding

API Keys Are Embedded in Request and WebSocket URLs

Content
View full analysis
r.ok ? r.json() : null); const funding = await fetch(`${BASE}/v1/wallet/${address}/funded-by?api-key=${KEY}`).then(r => r.ok ? r.json() : null); const { data: history } = await fetch(`${BASE}/v1/wallet/${address}/history?api-key=${KEY}&limit=20`).then(r => r.json()); ``` From `references/websockets.md`: ```typescript const WebSocket = require('ws'); const ws = new WebSocket('wss://mainnet.helius-rpc.com/?api-key=YOUR_API_KEY'); ``` ### Technical Analysis Secrets in query strings are more likely to be captured than secrets in protected authorization headers. Complete URLs may be recorded by: - Reverse proxies and gateway access logs. - Application performance ...[truncated 1475 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to install and run an MCP server via npx helius-mcp without a fixed version, which allows whatever package is current at execution time to be fetched and executed. If the upstream package is compromised, replaced, or a breaking release is published, users could run unreviewed code with their local privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

This second unpinned npx helius-cli@latest occurrence has the same supply-chain execution risk: it fetches and runs whatever code is current on the registry at the time of use. In the context of account signup and payment steps, compromise could lead to credential theft, malicious transaction prompts, or user fund loss.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 7)May include surrounding context.

sh
SKILL_NAME="helius"
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"

# Default: install to personal skills
TARGET_BASE="$HOME/.claude/skills"
MODE="personal"

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installer instructs users to add an MCP server using npx helius-mcp@latest, which pulls and executes the newest published package version at install/runtime rather than a reviewed, pinned release. If the package is compromised upstream or a breaking/malicious version is published, users could execute untrusted code in a high-trust local development context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The onboarding flow states that API keys, JWTs, and keypairs are automatically persisted to shared config and ~/.helius-cli/keypair.json without a prominent warning or consent step. Persisting long-lived credentials by default can expose sensitive secrets to other local users, backups, misconfigured permissions, or later compromise of the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The upgrade and renewal instructions describe executing plan changes and processing USDC payments, but do not clearly warn that these actions trigger real billing and may be irreversible or difficult to reverse. In an agentic workflow, insufficient confirmation language raises the risk of unintended financial transactions being initiated by users or automation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation instruction uses npx helius-mcp@latest, which pulls mutable code at execution time rather than a pinned, reviewed version. In an agent/tooling context, this increases supply-chain risk because a compromised or malicious newly published version could be executed immediately with the user's local privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill makes skipPreflight: true a mandatory requirement and states transactions will be rejected otherwise, but it does not clearly warn that preflight simulation is a safety check that helps catch malformed, failing, or unintended transactions before broadcast. In a transaction-sending skill, normalizing preflight bypass as default increases the chance that users submit invalid or unsafe transactions without understanding the tradeoff.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation makes a SOL tip transfer mandatory and provides concrete minimum amounts, but does not prominently warn that every transaction will spend additional user funds beyond the primary transaction intent. In wallet or agent-driven flows, this can lead to hidden or poorly understood balance depletion, especially when tips are dynamically increased from an external API.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sender.md (reported line 192)May include surrounding context.

md
transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sender.md (reported line 354)May include surrounding context.

md
transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sender.md (reported line 272)May include surrounding context.

md
const signedTx = await signTransactionMessageWithSigners(tx);
  const base64Tx = getBase64EncodedWireTransaction(signedTx);

  const res = await fetch("https://sender.helius-rpc.com/fast", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/wallet-api.md (reported line 17)May include surrounding context.

md
## MCP Tools

All Wallet API endpoints have direct MCP tools. ALWAYS use these instead of generating raw API calls:

| MCP Tool | Endpoint | What It Does |
|---|---|---|

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file instructs users to investigate wallets by identifying addresses, checking balances, and tracing funds, which can reveal sensitive financial and attribution information. The document does not include any caution about privacy, consent, or responsible handling of investigative results.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document explains that Helius pushes parsed transaction data to 'your server via HTTP POST' but does not include an explicit warning about data transmission to an external endpoint. Because this markdown file instructs users how to configure outbound delivery of account activity and transaction details, it should clearly disclose the privacy and data-handling implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/webhooks.md (reported line 52)May include surrounding context.

Via API (for application code)

bash
curl -X POST "https://api-mainnet.helius-rpc.com/v0/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The instructions require the agent to "ALWAYS use Orb" and explicitly forbid other explorers. This imposes a specific service preference on users without opt-in or justification, which fits the language/locale-style policy concern about forcing a particular user-facing choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The table states that deleteWebhook will 'Permanently remove a webhook', but the overall skill description does not provide a user-facing caution about the operational impact of this destructive action. Since markdown files should warn about behaviors affecting system integrity or monitoring continuity, the irreversible loss of event delivery should be called out more explicitly.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/onboarding.md:95