T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/track-whale.js:44- Finding
Undocumented Wallet Monitoring and External Network Disclosure Exceed Declared Skill Scope
- Content
View full analysis
Vulnerability Details
File Location:
scripts/track-whale.js:3-6, 11, 44-48, 66-76, 97-100
Vulnerability Type: Undocumented privacy-sensitive network activity and excessive functional scope
Risk Level: MediumComplete Code Snippet
js /** * Track large transfers for a specific wallet via Helius. * Usage: * node track-whale.js <wallet_address> <min_usd_value> [--lang zh|en] * node track-whale.js <wallet_address> <min_usd_value> --watch [--interval 30] [--lang zh|en] */ const { scanWhaleTransfers, createWhaleTracker } = require(path.join(sharedDir, 'services')); async function runOnce(address, minUsdValue) { const result = await scanWhaleTransfers({ address, minUsdValue, limit: 30, }); if (!result.events || result.events.length === 0) { console.log(isZh ? `✅ 最近 ${result.checked} 笔交易中未发现超过 ${formatUSD(minUsdValue)} 的大额转账。` : `✅ No whale transfers above ${formatUSD(minUsdValue)} found in the latest ${result.checked} transactions.`); return; } console.log(isZh ? '🐋 鲸鱼转账扫描结果:' : '🐋 Whale transfer scan:'); for (const event of result.events) { console.log(formatEventLine(event)); } } async function runWatch(address, minUsdValue) { const pollMs = Math.max(10, Number.isFinite(intervalSec) ? intervalSec : 30) * 1000; const tracker = createWhaleTracker({ address, minUsdValue, pollIntervalMs: pollMs, onEvent: (event) => { console.log(formatEventLine(event)); }, onError: () => { console.log(`⚠️ ${isZh ? '鲸鱼监听暂时失败，系统将继续重试。' : 'Whale tracking temporarily failed, retrying automatically.'}`); }, }); if (!config.heliusApiKey) { console.log(`❌ ${isZh ? '未配置 HELIUS_API_KEY，无法启用鲸鱼追踪。' : 'HELIUS_API_KEY is not configured. Whale tracking is unavailable.'}`); process.exit(1); } }Technical Analysis
...[truncated 3193 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
track-whale.jsfrom this Skill if wallet monitoring is not part of its intended price and market-overview functionality. - If the capability is intentional, separate it into a dedicated Skill with an explicit description, activation conditions, provider disclosure, and permission model.
- Require explicit user confirmation before transmitting a wallet address to Helius or any other external provider. State what data will be sent and whether watch mode creates continuing requests.
- Add
track-whale.jsto the documented available-scripts list and describe its arguments, network behavior, polling duration, and termination mechanism. - Bundle the relevant shared service implementation with the audited package, or pin it to a verifiable version so request destinations, TLS handling, logging, retention, and credential usage can be reviewed.
- Restrict outbound traffic to an allowlisted HTTPS endpoint and validate that wallet addresses and thresholds are the only user-derived values included in requests.
- Ensure the Helius API key is read from a protected secret store, never printed in errors or logs, and scoped or rate-limited where supported.
- Apply bounded execution controls to watch mode, such as a maximum duration or request count, and display a clear notice before continuous monitoring begins.
- Avoid storing queried addresses or transfer events unless necessary. If storage is required, define retention limits and provide appropriate redaction and deletion controls.
- Remove