Whistle RPC

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 PM UTC
• Version: 1.0.5

Overview

The skill is a coherent paid Solana RPC integration, but it uses unpinned npm execution and documents API keys in URLs, creating supply-chain and credential-leakage risks.

Review before installing. Use only if you trust the publisher and service, pin and verify the npm CLI before running it, avoid putting API keys in URLs when a header option is available, and require human confirmation before any real SOL payment or renewal using a dedicated low-value wallet.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: tools.json:22

Finding

Unpinned npm Package Is Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: tools.json:19-27
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

json

"subscription": {
  "price": "1 SOL",
  "duration": "30 days",
  "cli": "npx whistle-rpc subscribe",
  "endpoints": {
    "quote": "POST https://api.whistle.ninja/api/agent/subscribe",
    "activate": "POST https://api.whistle.ninja/api/agent/activate",
    "status": "GET https://api.whistle.ninja/api/agent/status/:apiKey"
  }
}

The same unversioned CLI is advertised in CHANGELOG.md:11:

markdown

- CLI: npx whistle-rpc

Technical Analysis

The command npx whistle-rpc subscribe does not specify an exact package version or integrity value. If the package is absent locally, npx can retrieve it from the configured npm registry and execute its exposed CLI. The artifact under review does not include the CLI source, a lockfile, an integrity hash, or another mechanism that binds execution to an audited package release.

Consequently, the code executed by this instruction can change after the skill has been reviewed. A compromised npm maintainer account, compromised package release, registry/configuration manipulation, or malicious future package version could cause arbitrary package code to run. Depending on the npm configuration and package contents, execution may include package lifecycle behavior as well as the requested CLI entry point.

Attack Path

1. An attacker compromises the whistle-rpc npm package, its publisher account, or the registry resolution path.
2. The attacker publishes or serves a malicious version that is selected by the unversioned package reference.
3. A user or agent follows the documented subscription procedure and runs npx whistle-rpc subscribe.
4. npx downloads the currently resolved package because no audited version is pinned.
5. The malicious package executes with the permis ...[truncated 769 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unversioned invocation with an exact, reviewed version, such as npx --yes whistle-rpc@1.0.0 subscribe, after independently auditing that release.
• Prefer installing the dependency through a committed lockfile and invoking the locked local binary rather than downloading code at execution time.
• Verify npm package integrity through lockfile integrity metadata, trusted provenance, and publisher/signature controls.
• Run the CLI in a sandbox or container with minimal filesystem access, no unrelated secrets, and a dedicated low-value wallet.
• Disable package lifecycle scripts where compatible, for example by using an npm configuration with ignore-scripts=true.
• Document the expected package publisher, checksum, supported version, and verification procedure.
• Require explicit operator approval before any installation or execution of code retrieved from a package registry.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

API Keys Are Transmitted in URL Query Parameters and Paths

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-35, SKILL.md:62, and SKILL.md:117-121
Vulnerability Type: Sensitive credential exposure through URLs
Risk Level: Medium

Vulnerable Code

SKILL.md:29-35 documents query-string authentication:

markdown

## Authentication

All endpoints require an API key obtained through subscription:

Query param: https://rpc.whistle.ninja?api_key=YOUR_KEY Header: X-API-Key: YOUR_KEY Header: Authorization: Bearer YOUR_KEY

text

SKILL.md:62 specifically requires query-string authentication for WebSocket connections:

markdown

Connect to `wss://rpc.whistle.ninja/ws` with your API key as a query param.

SKILL.md:117-121 places the API key in the subscription-status URL path:

markdown

### Check status

GET https://api.whistle.ninja/api/agent/status/YOUR_API_KEY

text

The same patterns are represented in tools.json:14-18 and tools.json:23-27:

json

"authentication": {
  "methods": ["query_param", "header"],
  "query_param": "api_key",
  "header": "X-API-Key"
}

json

"status": "GET https://api.whistle.ninja/api/agent/status/:apiKey"

Technical Analysis

Query strings and URL paths are frequently captured as complete URLs by reverse proxies, web-server access logs, API gateways, monitoring products, tracing systems, client diagnostics, command histories, and error reports. TLS protects the URL while it is in transit between properly authenticated endpoints, but it does not prevent credential-bearing URLs from being recorded at either endpoint or by authorized infrastructure components.

Embedding the API key in the WebSocket connection URL creates the same exposure risk during the HTTP upgrade request. Placing the key directly in the status endpoint path is especially problematic because URL paths are routinely treated as non-secret observability data.

Although head ...[truncated 1515 chars]

Remediation

View remediation

Remediation Suggestions

• Remove API-key authentication from query strings and URL paths.
• Require Authorization: Bearer <key> or X-API-Key: <key> for ordinary HTTPS requests.
• Redesign the status endpoint so the key is supplied in an authorization header rather than as a path parameter.
• For WebSocket authentication, exchange the long-lived API key over a protected header-based HTTPS endpoint for a short-lived, single-purpose connection token.
• Where WebSocket client limitations require a URL token, ensure it is short-lived, single-use, narrowly scoped, and automatically invalidated after connection establishment.
• Configure servers, proxies, gateways, and observability platforms to redact the api_key parameter and credential-like path segments.
• Prevent clients and agents from printing credential-bearing URLs in logs or error messages.
• Provide immediate key revocation and rotation mechanisms, and rotate any keys that may already have appeared in logs.
• Apply short expiration periods and least-privilege scopes to all issued credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The changelog instructs users to run npx whistle-rpc without pinning an exact package version. That causes execution of whatever version is current at install time, which creates a supply-chain risk if a future release is compromised, maliciously updated, or unexpectedly changes behavior. In this skill context, the risk is more relevant because the package is positioned for agent use and direct command execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

1. Request a quote

text

POST https://api.whistle.ninja/api/agent/subscribe
Content-Type: application/json

{ "walletAddress": "YOUR_WALLET_PUBKEY" }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

1. Request a quote

text

POST https://api.whistle.ninja/api/agent/subscribe
Content-Type: application/json

{ "walletAddress": "YOUR_WALLET_PUBKEY" }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

1. Request a quote

text

POST https://api.whistle.ninja/api/agent/subscribe
Content-Type: application/json

{ "walletAddress": "YOUR_WALLET_PUBKEY" }

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · tools.json (reported line 3)May include surrounding context.

json

{
  "name": "whistle-rpc",
  "description": "Solana RPC infrastructure -- unlimited requests, 1 SOL/month",
  "version": "1.0.0",
  "website": "https://whistle.ninja",
  "skill": "https://whistle.ninja/skill.md",

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The manifest instructs users to run npx whistle-rpc subscribe without pinning an exact package version or integrity. That creates a supply-chain risk: a later malicious or compromised package version could be fetched and executed automatically during subscription setup.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The subscription quote endpoint sends data to an external service, which is expected for this skill but still represents real external data transmission. In agent contexts, calling billing/subscription endpoints can expose identifiers, wallet-related metadata, or operational context to a third party and may initiate paid flows.

Content

Scanner excerpt · tools.json (reported line 23)May include surrounding context.

json

"duration": "30 days",
    "cli": "npx whistle-rpc subscribe",
    "endpoints": {
      "quote": "POST https://api.whistle.ninja/api/agent/subscribe",
      "activate": "POST https://api.whistle.ninja/api/agent/activate",
      "status": "GET https://api.whistle.ninja/api/agent/status/:apiKey"
    }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The activate endpoint is an external call tied to subscription activation and likely payment completion. In context, this is more sensitive than generic telemetry because it may finalize account state changes, expose API keys or wallet-linked metadata, and trigger billable service activation on behalf of a user.

Content

Scanner excerpt · tools.json (reported line 24)May include surrounding context.

json

"cli": "npx whistle-rpc subscribe",
    "endpoints": {
      "quote": "POST https://api.whistle.ninja/api/agent/subscribe",
      "activate": "POST https://api.whistle.ninja/api/agent/activate",
      "status": "GET https://api.whistle.ninja/api/agent/status/:apiKey"
    }
  },

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The status endpoint embeds :apiKey in the URL path, which is dangerous because API keys in URLs are commonly logged by clients, proxies, servers, browser history, and observability systems. This can lead to credential leakage and unauthorized use of the RPC service if logs or traces are exposed.

Content

Scanner excerpt · tools.json (reported line 25)May include surrounding context.

json

"endpoints": {
      "quote": "POST https://api.whistle.ninja/api/agent/subscribe",
      "activate": "POST https://api.whistle.ninja/api/agent/activate",
      "status": "GET https://api.whistle.ninja/api/agent/status/:apiKey"
    }
  },
  "tools": [

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This manifest describes the skill in broad terms and links to a remote skill description, but it does not define any explicit trigger phrases, scope boundaries, or exclusion conditions. In a manifest file, the absence of specific activation constraints can make invocation behavior ambiguous and increase the risk of unintended use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 41% confidence

Finding

The description advertises pricing only in SOL, which may imply a fixed currency/payment convention without any user choice or documented justification. This is a weak signal, but it could raise a natural-language policy concern if organizational policy requires offering locale or payment-language flexibility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.