Security audit

Helius

Security checks across malware telemetry and agentic risk

Overview

This Helius skill is coherent and not malicious, but it should be reviewed carefully because it can store sensitive keys and direct agents through real crypto payments, account changes, and on-chain transaction sending.

Install only if you trust the Helius MCP package and are comfortable with crypto transaction authority. Prefer a pinned MCP version, use a dedicated low-balance wallet, protect or remove locally saved keypair/API/JWT files, and require explicit approval before any signup, upgrade, renewal, token transfer, transaction send, webhook mutation, or wallet-profiling workflow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly states that API keys, JWTs, and a Solana keypair are persisted to shared config paths and ~/.helius-cli/keypair.json, but it does not warn that these are sensitive credentials whose compromise can enable account takeover, unauthorized API usage, billing abuse, or wallet misuse. In an agent/MCP context where tools may run on shared hosts, developer workstations, or multi-user environments, silent disk persistence materially increases exposure if file permissions, backups, logs, or other local processes are not tightly controlled.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The onboarding instructions describe agenticSignup as processing a USDC payment and auto-configuring credentials, but they do not prominently warn that invoking the action causes real financial charges and potentially irreversible account creation or plan activation. In an autonomous agent setting, insufficient emphasis on billing side effects can lead to unintended purchases, especially if an agent follows the flow automatically after detecting sufficient funds.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document mandates `skipPreflight: true` for every submission without prominently explaining that this bypasses client-side simulation checks and increases the chance of broadcasting malformed, failing, or unintended transactions. In a transaction-sending skill, that omission is security-relevant because users may copy the pattern directly and lose an important validation layer before signing and submission.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The documentation instructs users to expose an HTTPS webhook endpoint and send parsed on-chain event data to their server, but it does not prominently warn about the security implications of operating a public inbound HTTP surface. Without an explicit warning near setup guidance, users may deploy unauthenticated or weakly protected endpoints, increasing the risk of spoofed requests, abuse, or unintended data exposure.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: references/onboarding.md:95