Helius

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:04 PM UTC
• Version: 1.0.0

Overview

This Solana developer skill appears purpose-aligned, but it gives agents access to payments, persisted credentials, and transaction submission while relying on mutable npm installs and under-disclosed safety tradeoffs.

Review this skill before installing in any wallet, production, or billing context. Pin and verify the Helius MCP/CLI packages instead of using @latest, keep funded signup wallets at the minimum balance, require explicit confirmation before payments, upgrades, renewals, tips, or transaction signing, prefer HTTPS endpoints, authenticate webhook receivers, and protect or rotate any API keys, JWTs, and keypair files it creates.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Mutable npm Packages Are Executed Through Unpinned npx Commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:18-28`, `install.sh:69-75`, `references/onboarding.md:188-192` **Vulnerability Type**: Supply-chain exposure through mutable dependencies **Risk Level**: Medium ### Vulnerable Code From `SKILL.md`: ```markdown ### 1. Helius MCP Server **CRITICAL**: Check if Helius MCP tools are available (e.g., `getBalance`, `getAssetsByOwner`). If NOT available, **STOP** and tell the user: `claude mcp add helius npx helius-mcp@latest` then restart Claude. ### 2. API Key If any MCP tool returns "API key not configured": **Path A — Existing key:** Use `setHeliusApiKey` with their key from https://dashboard.helius.dev. **Path B — Agentic signup:** `generateKeypair` → user funds wallet with **~0.001 SOL** for fees + **USDC** (USDC mint: `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`) — **1 USDC** basic, **$49** Developer, **$499** Business, **$999** Professional → `checkSignupBalance` → `agenticSignup`. **Do NOT skip steps** — on-chain payment required. **Path C — CLI:** `npx helius-cli@latest keygen` → fund wallet → `npx helius-cli@latest signup` ``` From `install.sh`: ```bash echo "Next steps:" echo " 1. Install the Helius MCP server (if not already):" echo " claude mcp add helius npx helius-mcp@latest" echo "" echo " 2. Set your API key (if not already):" echo " export HELIUS_API_KEY=your-api-key" echo " Or use the setHeliusApiKey MCP tool in Claude Code" ``` From `references/onboarding.md`: ```bash claude mcp add helius npx helius-mcp@latest ``` ### Technical Analysis The Skill instructs users to execute `helius-mcp@latest` and `helius-cli@latest` directly through `npx`. The `latest` distribution tag is mutable, so the code executed in the future is not necessarily the code that existed when this Skill was audited. No lockfile, exact package version, integrity hash, or package-content verification is supplied. This creates a supply-chain trust boundary around npm, the package publisher ...[truncated 1613 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with an exact, reviewed version: ```bash claude mcp add helius npx --yes helius-mcp@X.Y.Z npx --yes helius-cli@X.Y.Z keygen ``` 2. Document the expected npm package owner, repository, and release provenance. 3. Use a lockfile or locally installed dependency rather than downloading executable code at invocation time. 4. Verify package integrity through a reviewed package hash, signed provenance, or trusted release process. 5. Review dependency updates before changing the pinned version. 6. Run the MCP server with least privilege and isolate it from unrelated secrets. 7. Keep funded signup wallets limited to the minimum required balance. 8. Restrict permissions on keypair and shared configuration files. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/sender.md:82
• Finding: Signed Transactions May Be Submitted Over Unencrypted HTTP<![CDATA[ ## Vulnerability Details **File Location**: `references/sender.md:82-90`, `references/sender.md:399-412` **Vulnerability Type**: Plaintext transport of signed blockchain transactions **Risk Level**: Medium ### Vulnerable Code ```markdown ### Backend (Regional HTTP — use for servers) Choose the endpoint closest to your infrastructure: ```text http://slc-sender.helius-rpc.com/fast # Salt Lake City http://ewr-sender.helius-rpc.com/fast # Newark http://lon-sender.helius-rpc.com/fast # London http://fra-sender.helius-rpc.com/fast # Frankfurt http://ams-sender.helius-rpc.com/fast # Amsterdam http://sg-sender.helius-rpc.com/fast # Singapore http://tyo-sender.helius-rpc.com/fast # Tokyo ``` ``` The connection-warming example also permits a regional HTTP endpoint: ```typescript // Ping every 30 seconds during idle periods const endpoint = 'https://sender.helius-rpc.com'; // or regional HTTP endpoint setInterval(async () => { try { await fetch(`${endpoint}/ping`); } catch { // Ignore ping failures } }, 30_000); ``` ```markdown Ping endpoints: - HTTPS: `https://sender.helius-rpc.com/ping` - Regional: `http://{region}-sender.helius-rpc.com/ping` (slc, ewr, lon, fra, ams, sg, tyo) ``` ### Technical Analysis HTTP does not provide transport confidentiality, server authentication, or transport-level integrity. The Sender request body contains a signed, serialized transaction. The transaction does not contain the signer's private key, and its cryptographic signature prevents an intermediary from silently changing signed instructions without invalidating the signature. Nevertheless, an on-path attacker can: - Read the complete transaction before it lands on-chain. - Submit the observed transaction through another endpoint before the original request. - Drop or delay the request. - Forge an HTTP response to mislead the application. - Observe a Sender API key if a key is appended to an HTTP URL. - Analyze time- ...[truncated 1397 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require HTTPS/TLS for all transaction-submission and health-check endpoints. 2. Remove plain-HTTP regional endpoints from recommended application templates. 3. If regional services cannot directly provide TLS, access them only through an authenticated TLS tunnel, private network, or trusted service mesh. 4. Never append API credentials to a plain-HTTP endpoint. 5. Validate JSON-RPC response structure and independently confirm returned signatures through a trusted TLS-protected RPC endpoint. 6. Apply strict timeouts and avoid treating an unauthenticated HTTP response as proof of transaction acceptance or confirmation. 7. Document that signed transactions do not expose private keys but can reveal pending financial intent. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/webhooks.md:163
• Finding: Webhook Receiver Template Processes Unauthenticated Events<![CDATA[ ## Vulnerability Details **File Location**: `references/webhooks.md:163-176` **Vulnerability Type**: Missing webhook-origin authentication **Risk Level**: Medium ### Vulnerable Code ```typescript app.post('/webhook', (req, res) => { for (const event of req.body) { if (processed.has(event.signature)) continue; processed.add(event.signature); // Route by event.type — access event.nativeTransfers, event.tokenTransfers, event.description } res.status(200).send('OK'); }); ``` The document later acknowledges the issue, but the secure control is not implemented in the primary template: ```markdown - Exposing webhook endpoint without authentication — add a shared secret or signature verification in production ``` ### Technical Analysis The handler trusts every HTTP client able to reach `/webhook`. Deduplication by `event.signature` only prevents repeated processing of the same supplied value; it does not prove that the event came from Helius or that the signature corresponds to the described on-chain transaction. An attacker can create a unique fake signature for every request and supply arbitrary values in fields such as: - `type` - `description` - `nativeTransfers` - `tokenTransfers` - `feePayer` - `transactionError` If downstream logic sends notifications, updates accounting records, credits users, or triggers automation based on these values, forged requests can produce unauthorized actions. ### Attack Path 1. A developer copies the documented receiver into a public application. 2. The webhook endpoint becomes reachable from the internet. 3. An attacker sends a crafted POST body containing a fake transfer, swap, sale, or governance event. 4. The attacker chooses a fresh `signature` value to bypass the deduplication set. 5. The handler processes the event without authenticating its source or independently validating it on-chain. 6. Downstream business logic acts on attacker-controlled event data. ### Impact Assessment The dire ...[truncated 535 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make source authentication part of the primary receiver template rather than an optional production note. 2. If Helius provides signed webhook requests, verify the signature over the unmodified raw request body before JSON parsing. 3. If signed delivery is unavailable, use a high-entropy shared secret communicated through a protected header or endpoint configuration and compare it in constant time. 4. Reject requests with missing or invalid authentication before processing any event. 5. Add timestamp or nonce validation where supported to prevent replay. 6. Independently verify security-sensitive events against a trusted blockchain RPC before crediting funds or executing irreversible actions. 7. Validate the request schema, body size, event count, field types, and allowed transaction types. 8. Preserve deduplication and durable idempotency controls, but do not treat them as authentication. 9. Apply rate limiting and network-level restrictions where practical. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/priority-fees.md:30
• Finding: API Keys Are Embedded in Request and WebSocket URLs<![CDATA[ ## Vulnerability Details **File Location**: `references/priority-fees.md:30-69`; also present in `references/wallet-api.md:12-15,130-132` and `references/websockets.md:18-19,56-58` **Vulnerability Type**: Credential exposure through URL query strings **Risk Level**: Low ### Vulnerable Code From `references/priority-fees.md`: ```typescript const response = await fetch(`https://mainnet.helius-rpc.com/?api-key=${API_KEY}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'getPriorityFeeEstimate', params: [{ accountKeys: ['JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4'], options: { priorityLevel: 'High' } }] }) }); ``` ```typescript const response = await fetch(`https://mainnet.helius-rpc.com/?api-key=${API_KEY}`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'getPriorityFeeEstimate', params: [{ transaction: base64EncodedTransaction, options: { transactionEncoding: 'Base64', recommended: true, } }] }) }); ``` From `references/wallet-api.md`: ```typescript const identity = await fetch(`${BASE}/v1/wallet/${address}/identity?api-key=${KEY}`).then(r => r.ok ? r.json() : null); const funding = await fetch(`${BASE}/v1/wallet/${address}/funded-by?api-key=${KEY}`).then(r => r.ok ? r.json() : null); const { data: history } = await fetch(`${BASE}/v1/wallet/${address}/history?api-key=${KEY}&limit=20`).then(r => r.json()); ``` From `references/websockets.md`: ```typescript const WebSocket = require('ws'); const ws = new WebSocket('wss://mainnet.helius-rpc.com/?api-key=YOUR_API_KEY'); ``` ### Technical Analysis Secrets in query strings are more likely to be captured than secrets in protected authorization headers. Complete URLs may be recorded by: - Reverse proxies and gateway access logs. - Application performance ...[truncated 1475 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Use an authorization header wherever the endpoint supports one: ```typescript const response = await fetch(`${BASE}/v1/wallet/${address}/history?limit=20`, { headers: { 'X-Api-Key': process.env.HELIUS_API_KEY!, }, }); ``` 2. Never log complete URLs that may contain API keys. 3. Configure reverse proxies, APM systems, and exception reporters to redact `api-key` query parameters. 4. Keep credentials in environment variables or a secret manager rather than source code. 5. Use separate, narrowly scoped keys for development and production where supported. 6. Rotate any key that may have appeared in logs. 7. For protocols that require query-string authentication, construct the URL immediately before connection, avoid printing it, and document the unavoidable leakage risk. 8. Apply usage monitoring and alerts for anomalous API-credit consumption. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (18)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The skill instructs users to install and run an MCP server via `npx helius-mcp` without a fixed version, which allows whatever package is current at execution time to be fetched and executed. If the upstream package is compromised, replaced, or a breaking release is published, users could run unreviewed code with their local privileges.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: This second unpinned `npx helius-cli@latest` occurrence has the same supply-chain execution risk: it fetches and runs whatever code is current on the registry at the time of use. In the context of account signup and payment steps, compromise could lead to credential theft, malicious transaction prompts, or user fund loss.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

SKILL_NAME="helius"
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"

# Default: install to personal skills
TARGET_BASE="$HOME/.claude/skills"
MODE="personal"

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The installer instructs users to add an MCP server using `npx helius-mcp@latest`, which pulls and executes the newest published package version at install/runtime rather than a reviewed, pinned release. If the package is compromised upstream or a breaking/malicious version is published, users could execute untrusted code in a high-trust local development context.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding flow states that API keys, JWTs, and keypairs are automatically persisted to shared config and `~/.helius-cli/keypair.json` without a prominent warning or consent step. Persisting long-lived credentials by default can expose sensitive secrets to other local users, backups, misconfigured permissions, or later compromise of the host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The upgrade and renewal instructions describe executing plan changes and processing USDC payments, but do not clearly warn that these actions trigger real billing and may be irreversible or difficult to reverse. In an agentic workflow, insufficient confirmation language raises the risk of unintended financial transactions being initiated by users or automation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The installation instruction uses `npx helius-mcp@latest`, which pulls mutable code at execution time rather than a pinned, reviewed version. In an agent/tooling context, this increases supply-chain risk because a compromised or malicious newly published version could be executed immediately with the user's local privileges.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill makes `skipPreflight: true` a mandatory requirement and states transactions will be rejected otherwise, but it does not clearly warn that preflight simulation is a safety check that helps catch malformed, failing, or unintended transactions before broadcast. In a transaction-sending skill, normalizing preflight bypass as default increases the chance that users submit invalid or unsafe transactions without understanding the tradeoff.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation makes a SOL tip transfer mandatory and provides concrete minimum amounts, but does not prominently warn that every transaction will spend additional user funds beyond the primary transaction intent. In wallet or agent-driven flows, this can lead to hidden or poorly understood balance depletion, especially when tips are dynamically increased from an external API.

External Transmission

Medium

• Category: Data Exfiltration

Content

transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

transaction.sign([keypair]);

  // 5. Submit to Sender
  const response = await fetch('https://sender.helius-rpc.com/fast', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

const signedTx = await signTransactionMessageWithSigners(tx);
  const base64Tx = getBase64EncodedWireTransaction(signedTx);

  const res = await fetch("https://sender.helius-rpc.com/fast", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Behavior Manipulation

Medium

• Category: Prompt Injection

Content

## MCP Tools

All Wallet API endpoints have direct MCP tools. ALWAYS use these instead of generating raw API calls:

| MCP Tool | Endpoint | What It Does |
|---|---|---|

• Confidence: 70% confidence
• Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This markdown file instructs users to investigate wallets by identifying addresses, checking balances, and tracing funds, which can reveal sensitive financial and attribution information. The document does not include any caution about privacy, consent, or responsible handling of investigative results.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explains that Helius pushes parsed transaction data to 'your server via HTTP POST' but does not include an explicit warning about data transmission to an external endpoint. Because this markdown file instructs users how to configure outbound delivery of account activity and transaction details, it should clearly disclose the privacy and data-handling implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Via API (for application code)

```bash
curl -X POST "https://api-mainnet.helius-rpc.com/v0/webhooks" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The instructions require the agent to "ALWAYS use Orb" and explicitly forbid other explorers. This imposes a specific service preference on users without opt-in or justification, which fits the language/locale-style policy concern about forcing a particular user-facing choice.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The table states that `deleteWebhook` will 'Permanently remove a webhook', but the overall skill description does not provide a user-facing caution about the operational impact of this destructive action. Since markdown files should warn about behaviors affecting system integrity or monitoring continuity, the irreversible loss of event delivery should be called out more explicitly.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/onboarding.md:95