T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/track-whale.js:44
- Finding
- Undocumented Wallet Monitoring and External Network Disclosure Exceed Declared Skill Scope## Vulnerability Details **File Location**: `scripts/track-whale.js:3-6, 11, 44-48, 66-76, 97-100` **Vulnerability Type**: Undocumented privacy-sensitive network activity and excessive functional scope **Risk Level**: Medium ### Complete Code Snippet ```js /** * Track large transfers for a specific wallet via Helius. * Usage: * node track-whale.js <wallet_address> <min_usd_value> [--lang zh|en] * node track-whale.js <wallet_address> <min_usd_value> --watch [--interval 30] [--lang zh|en] */ const { scanWhaleTransfers, createWhaleTracker } = require(path.join(sharedDir, 'services')); async function runOnce(address, minUsdValue) { const result = await scanWhaleTransfers({ address, minUsdValue, limit: 30, }); if (!result.events || result.events.length === 0) { console.log(isZh ? `✅ 最近 ${result.checked} 笔交易中未发现超过 ${formatUSD(minUsdValue)} 的大额转账。` : `✅ No whale transfers above ${formatUSD(minUsdValue)} found in the latest ${result.checked} transactions.`); return; } console.log(isZh ? '🐋 鲸鱼转账扫描结果:' : '🐋 Whale transfer scan:'); for (const event of result.events) { console.log(formatEventLine(event)); } } async function runWatch(address, minUsdValue) { const pollMs = Math.max(10, Number.isFinite(intervalSec) ? intervalSec : 30) * 1000; const tracker = createWhaleTracker({ address, minUsdValue, pollIntervalMs: pollMs, onEvent: (event) => { console.log(formatEventLine(event)); }, onError: () => { console.log(`⚠️ ${isZh ? '鲸鱼监听暂时失败，系统将继续重试。' : 'Whale tracking temporarily failed, retrying automatically.'}`); }, }); if (!config.heliusApiKey) { console.log(`❌ ${isZh ? '未配置 HELIUS_API_KEY，无法启用鲸鱼追踪。' : 'HELIUS_API_KEY is not configured. Whale tracking is unavailable.'}`); process.exit(1); } } ``` ### Technical Analysis ...[truncated 3193 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `track-whale.js` from this Skill if wallet monitoring is not part of its intended price and market-overview functionality. 2. If the capability is intentional, separate it into a dedicated Skill with an explicit description, activation conditions, provider disclosure, and permission model. 3. Require explicit user confirmation before transmitting a wallet address to Helius or any other external provider. State what data will be sent and whether watch mode creates continuing requests. 4. Add `track-whale.js` to the documented available-scripts list and describe its arguments, network behavior, polling duration, and termination mechanism. 5. Bundle the relevant shared service implementation with the audited package, or pin it to a verifiable version so request destinations, TLS handling, logging, retention, and credential usage can be reviewed. 6. Restrict outbound traffic to an allowlisted HTTPS endpoint and validate that wallet addresses and thresholds are the only user-derived values included in requests. 7. Ensure the Helius API key is read from a protected secret store, never printed in errors or logs, and scoped or rate-limited where supported. 8. Apply bounded execution controls to watch mode, such as a maximum duration or request count, and display a clear notice before continuous monitoring begins. 9. Avoid storing queried addresses or transfer events unless necessary. If storage is required, define retention limits and provide appropriate redaction and deletion controls.