ClawHub
Back to skill

Security audit

SVM

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and not malicious, but it asks users to register an unpinned third-party MCP package that may later run different code on their machine.

Review the Helius MCP package provenance before installing. Prefer a pinned version or a vetted local install method, and understand that registering the MCP server can allow package code to run under your user account in Claude sessions. The bundled skill content itself is scoped to public Solana research and does not request credentials or private files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding
Unpinned npm Package Execution Through Helius MCP Setup## Vulnerability Details **File Location**: `SKILL.md:16-24`; duplicated in `install.sh:68-73` **Vulnerability Type**: Unpinned third-party dependency and mutable remote package execution **Risk Level**: Medium ### Vulnerable Code `SKILL.md:16-24`: ```markdown **CRITICAL**: Check that the Helius knowledge tools are available (`searchSolanaDocs`, `fetchHeliusBlog`, `getSIMD`, `readSolanaSourceFile`). If they are NOT available, **STOP** and tell the user: ``` You need to install the Helius MCP server first: claude mcp add helius npx helius-mcp@latest Then restart Claude so the tools become available. ``` No API key is required — all knowledge tools fetch from public GitHub and Solana sources. ``` `install.sh:68-73`: ```bash echo "Next steps:" echo " 1. Install the Helius MCP server (if not already):" echo " claude mcp add helius npx helius-mcp@latest" echo "" echo " 2. No API key required — all tools fetch from public sources." ``` ### Technical Analysis The prescribed MCP registration command uses `npx` with the mutable npm tag `helius-mcp@latest`. Unlike an exact version or integrity-locked artifact, `@latest` can resolve to different package contents after this Skill has been reviewed. When the MCP server is launched, `npx` may download and execute package-controlled JavaScript under the current user's account. Therefore, compromise of the npm package, publisher account, release pipeline, or a future package release could transform an otherwise legitimate setup instruction into arbitrary local code execution. The Skill only needs access to public documentation and source code to provide its declared educational functionality. Requiring execution of a mutable third-party package exceeds the minimum risk necessary to obtain static public information. The installer itself does not download or execute the package; it prints the unsafe setup command. `SKILL.md` makes the MCP server a mandatory prer ...[truncated 1799 chars]
Remediation
## Remediation Suggestions 1. Replace `helius-mcp@latest` with an exact, reviewed version, for example `helius-mcp@X.Y.Z`. 2. Verify the selected package version against a documented integrity hash or lockfile before execution. 3. Document the canonical npm publisher, source repository, and release provenance so users can validate package ownership. 4. Avoid automatic or mandatory third-party execution. Present MCP installation as an explicit trust decision requiring user confirmation. 5. Prefer a locally installed, dependency-locked MCP server over downloading code dynamically whenever Claude starts it. 6. Run the MCP server with least privilege in a sandbox or container that restricts filesystem access, environment variables, subprocess creation, and outbound network destinations. 7. Apply the same pinned command consistently in both `SKILL.md` and `install.sh`. 8. Periodically review and deliberately update the pinned version rather than following a mutable distribution tag.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The skill instructs users to install and execute an MCP server via `npx helius-mcp@latest`, which is an unpinned package reference that can change over time. If the upstream package, dependency chain, or published version is compromised, users could run unexpected code simply by following the setup instructions. In this context the risk is heightened because the skill explicitly tells users to install and run the tool before the skill can function.

Skill Enumeration

Medium
Category
Agent Snooping
Content
SKILL_NAME="svm"
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)"

# Default: install to personal skills
TARGET_BASE="$HOME/.claude/skills"
MODE="personal"
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding
The installer instructs users to add an MCP server via `npx helius-mcp@latest`, which is effectively an unpinned moving target. If the package is compromised upstream or a breaking/malicious release is published, users following the printed instructions may execute unreviewed code on their machine.

Static analysis

No suspicious patterns detected.