Security audit

solana-skill

Security checks across malware telemetry and agentic risk

Overview

This is a real Solana wallet and trading helper, but it can move funds and store wallet keys with safeguards that are too weak for that level of risk.

Install only after reviewing the code and limiting its authority. Use a test or low-value wallet, replace the wallet encryption approach before storing meaningful funds, require manual approval for every send or swap, verify addresses and amounts independently, and avoid exposing Helius API keys or wallet activity in logs or untrusted webhook endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises concrete network and local configuration usage, including outbound calls to Helius and Jupiter and reading an API key from a user config file, but it declares no permissions. That mismatch can undermine user trust and permission gating because a caller may not realize the skill can access local config and transmit data externally.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The wallet encryption key is deterministically derived from USER and HOME, which are low-entropy, guessable, and often accessible to local users or attackers with limited host knowledge. Anyone who obtains the wallet file and can reconstruct or brute-force the machine-derived password can decrypt the private key, making the at-rest encryption largely ineffective for a crypto wallet.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The description says to use the skill for 'any Solana blockchain operation' and broad wallet/DeFi activities, which is overly expansive for a high-risk financial skill. Broad triggering can cause the agent to invoke transaction-capable functionality in ambiguous situations, increasing the chance of unintended fund movement or sensitive wallet handling.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill includes dangerous capabilities such as importing private keys or seed phrases, sending tokens, and executing swaps, but the warninging around these high-risk actions is not prominent in the main capability description. In a wallet-management context, insufficient up-front warnings materially increase the risk of users exposing secrets or authorizing irreversible blockchain transactions without informed consent.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The reference directs users to send API keys and wallet/address or transaction data to a third-party service without any privacy or data-sharing warning. In a blockchain skill, addresses and transaction activity can still be sensitive metadata, and omission of disclosure can lead users to expose operational or portfolio information they did not expect to share.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The webhook instructions tell users to forward monitored address activity to an arbitrary external endpoint but do not warn that all matched transaction data will be continuously transmitted there. In the context of crypto wallet monitoring, this can leak sensitive financial activity, enable surveillance of wallet behavior, or expose data to insecure or misconfigured endpoints.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The example shows a complete live swap flow that signs and broadcasts a transaction with `sendRawTransaction(..., { skipPreflight: true })` but does not include an explicit warning that this performs a real on-chain trade using real funds. In a wallet-management skill, users or downstream agents may copy this example directly, increasing the risk of unintended asset movement, bad fills, or irreversible swaps.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code signs and broadcasts a live swap transaction immediately after building it, with no explicit user confirmation step and no human-readable preview of the transaction details. In a wallet-management skill, this is dangerous because a bad route, unexpected slippage, compromised upstream quote/swap response, or simple operator mistake can directly cause irreversible on-chain asset loss.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The skill sends the user's public key and quote/swap metadata to Jupiter's external API without clearly warning the operator that wallet-linked trading intent and routing details are being shared with a third party. This is primarily a privacy and operational transparency issue rather than a direct compromise, but in blockchain workflows address linkage can expose portfolio behavior and trading patterns.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/wallet.ts:73

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/wallet.ts:87