fetch-solana-logs

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it pushes agents to immediately run package installs and persist an API key without enough user confirmation or local secret protections.

Install only if you are comfortable with the agent creating a local project, writing target addresses and outputs, installing npm packages, and possibly storing a Helius API key in .env. Prefer reviewing the commands first, using a temporary/restricted Helius key, ensuring .env is gitignored and permission-restricted, and running dependency installation yourself from a locked dependency set.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/init-project.sh:47

Finding

Automatic Installation of Unpinned Dependencies Without a Lockfile

Content

View full analysis

/dev/null 2>&1; then (cd "$TARGET_DIR" && pnpm install) elif command -v npm >/dev/null 2>&1; then (cd "$TARGET_DIR" && npm install) else echo "No pnpm/npm found. Run install manually in $TARGET_DIR" exit 1 fi ``` ```json "dependencies": { "@coral-xyz/anchor": "^0.32.1", "@solana/web3.js": "^1.98.4", "JSONStream": "^1.3.5", "axios": "^1.18.1", "bs58": "^6.0.0", "dayjs": "^1.11.21", "decimal.js": "^10.6.0", "dotenv": "^17.4.2", "stream-chain": "^3.4.0", "stream-json": "^1.9.1" }, "devDependencies": { "@types/node": "^26.1.1", "tsx": "^4.23.1", "typescript": "^7.0.2" } ``` ### Technical Analysis The scaffolding script automatically invokes `pnpm install` or `npm install`. The project does not ship a lockfile, while direct dependencies use caret version ranges. Consequently, each installation can resolve a different direct and transitive dependency graph. Package installation can run package lifecycle scripts under the privileges of the user running the Skill. If a dependency or transitive dependency is compromised, unexpectedly replaced, or publishes a malicious version allowed by the declared ranges, installation can execute attacker-controlled code before the transaction-fetching workflow begins. The dependency surface is larger than necessary. For example, `axios`, `JSONStream`, `stream-chain`, `stream-json`, `dayjs`, and `decimal.js` are included even though several are not required by the primary Solana pull and parse path. This increases the number of packages and transitive components that must remain trustworthy. ### Attack Path 1. An attacker compromises a permitted direct or transitive package version, or its publisher account. 2. The ...[truncated 988 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/init-project.sh:33

Finding

Helius API Key Written Without Explicit File Permission or Version-Control Protection

Content

View full analysis

"$TARGET_DIR/.env" elif [ ! -f "$TARGET_DIR/.env" ] && [ -f "$TARGET_DIR/.env.example" ]; then cp "$TARGET_DIR/.env.example" "$TARGET_DIR/.env" fi ``` ### Technical Analysis The script writes the user-provided Helius API key in plaintext to `.env`. It does not establish a restrictive `umask`, explicitly set the resulting file to mode `0600`, or generate a `.gitignore` that excludes `.env`. The effective permissions therefore depend on the caller's ambient umask. In a shared environment, the file could be readable by unintended local users or service accounts. A generated project could also be initialized as or copied into a source repository, allowing `.env` to be committed accidentally. The Skill documentation correctly instructs the Agent not to print the key and to write it only into the operated project. No deliberate credential exfiltration was found; the weakness is the absence of local secret-storage hardening. ### Attack Path 1. A user provides `HELIUS_API_KEY` to the Agent. 2. The Agent passes the key to `init-project.sh`. 3. The script creates `$TARGET_DIR/.env` using the caller's current umask. 4. One of the following occurs: - Another local account with sufficient read access opens the file. - The project is archived, synchronized, or backed up without excluding `.env`. - The project is committed to version control and the `.env` file is published. 5. The API key is recovered and used without the owner's authorization. ### Impact Assessment The likely impact is unauthorized consumption of the user's Helius API quo ...[truncated 262 chars]

Remediation

View remediation

"$TARGET_DIR/.env" ) chmod 600 "$TARGET_DIR/.env" ``` 2. Add a generated `.gitignore` containing at least: ```gitignore .env .env.* !.env.example output/ ``` 3. Warn if `.env` is already tracked by Git. 4. Preserve unrelated `.env` entries through a safe update mechanism rather than replacing the entire file when scaffolding. 5. Prefer a platform secret manager or credential store where available. 6. Document credential revocation and rotation procedures in case `.env` is exposed. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: templates/src/tx_logs/s1.pull.tx.ts:233

Finding

Helius API Credential Embedded in Request Query Strings

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill should pull/sync Solana transactions and optionally decode them, with an operational step of writing the address to target_solana_addr.json and running downstream steps. The supplied code chunk instead implements a validation utility: it reads addresses from CLI args or an existing config file, checks them with isSolanaAddress, and exits on failure. This is related to the overall workflow as a supporting preflight check, but by itself it materially differs from the declared primary purpose because none of the fetch/parse/decode behavior is present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose describes an operational Solana data retrieval/parsing skill, but the actual code chunk is only ambient TypeScript declarations to satisfy imports for JSON streaming libraries. These declarations are a supporting/build-time typing artifact and, by themselves, do not implement any of the advertised behavior or triggers. Therefore the supplied code does not accurately represent the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description centers on automatically retrieving and parsing Solana transactions/logs for a supplied address or program. However, this code chunk only contains generic utility functions: streaming CSV and JSON files, validating numeric strings, recursively listing files, writing allocation CSVs, checking whether a string is a valid Solana public key, sleeping, and reading the last line of a file. While isSolanaAddress is tangentially related to Solana, the module’s primary behavior is local file/data processing rather than network-based Solana transaction retrieval or instruction decoding. Therefore the actual behavior does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The workflow explicitly includes ensuring and potentially modifying .env contents to obtain and store HELIUS_API_KEY, which is credential handling. In this context the danger is not merely reading config but normalizing agent access to secrets and persisting them, increasing exposure risk if the workspace is shared or later committed.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

→ validate with isSolanaAddress (must pass) → ensure project (scaffold if needed) → write target_solana_addr.json → ensure .env (HELIUS_API_KEY) → pnpm s1 → pnpm s2 → report output paths

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The checklist operationalizes persistence of HELIUS_API_KEY in .env as a routine completion criterion, which bakes secret handling into normal execution. That increases the likelihood of unnecessary credential storage and normalizes broad agent interaction with sensitive local configuration.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

- [ ] isSolanaAddress(addr) === true (pnpm validate)
- [ ] Project ready (existing or init-project.sh)
- [ ] Address(es) written to target_solana_addr.json
- [ ] HELIUS_API_KEY in .env (or public-RPC fallback acknowledged)
- [ ] pnpm s1 (default --limit 50) completed
- [ ] pnpm s2 completed
- [ ] User told output paths / IDL status

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The example shows handling an API key during project initialization and indicates that init creates a .env file, which encourages local persistence of credentials in the workspace. Storing secrets in project files can lead to accidental exposure through source control, logs, backups, or later agent actions that read and surface file contents.

Content

Scanner excerpt · examples.md (reported line 13)May include surrounding context.

md

# 0) validate first (isSolanaAddress)
pnpm validate -- --addr DLvbp3sZCdoK6FoGnMdLSP2NZCCZdVfSGHD8KAGazZQH

# 1) if no project; when user supplied a key, init creates .env
HELIUS_API_KEY="$HELIUS_API_KEY" \
  bash ~/.cursor/skills/fetch-solana-logs/scripts/init-project.sh ./fetch_solana_logs
cd ./fetch_solana_logs

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The example explicitly instructs creating or updating a .env with a user-supplied key, which is direct credential persistence in the working directory. In an agent workflow this is especially risky because the agent may later inspect, modify, commit, or expose workspace files, turning a convenience step into potential credential leakage.

Content

Scanner excerpt · examples.md (reported line 21)May include surrounding context.

md

# 2) write config (only after OK)
printf '%s\n' '["DLvbp3sZCdoK6FoGnMdLSP2NZCCZdVfSGHD8KAGazZQH"]' > target_solana_addr.json

# 3) if project already existed, create/update its .env with the supplied key
# HELIUS_API_KEY=<user-provided-key>

# 4) pull + parse

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 39)May include surrounding context.

sh

if [ -n "${SOLANA_RPC_URL:-}" ]; then
      printf 'SOLANA_RPC_URL=%s\n' "$SOLANA_RPC_URL"
    fi
  } > "$TARGET_DIR/.env"
elif [ ! -f "$TARGET_DIR/.env" ] && [ -f "$TARGET_DIR/.env.example" ]; then
  cp "$TARGET_DIR/.env.example" "$TARGET_DIR/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 40)May include surrounding context.

sh

if [ -n "${SOLANA_RPC_URL:-}" ]; then
      printf 'SOLANA_RPC_URL=%s\n' "$SOLANA_RPC_URL"
    fi
  } > "$TARGET_DIR/.env"
elif [ ! -f "$TARGET_DIR/.env" ] && [ -f "$TARGET_DIR/.env.example" ]; then
  cp "$TARGET_DIR/.env.example" "$TARGET_DIR/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 41)May include surrounding context.

sh

if [ -n "${SOLANA_RPC_URL:-}" ]; then
      printf 'SOLANA_RPC_URL=%s\n' "$SOLANA_RPC_URL"
    fi
  } > "$TARGET_DIR/.env"
elif [ ! -f "$TARGET_DIR/.env" ] && [ -f "$TARGET_DIR/.env.example" ]; then
  cp "$TARGET_DIR/.env.example" "$TARGET_DIR/.env"
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.zh.md (reported line 161)May include surrounding context.

md

echo ""
echo "Done. Next steps:"
echo "  1. Ask user for Solana address(es); write target_solana_addr.json"
echo "  2. Set HELIUS_API_KEY in .env (recommended)"
echo "  3. pnpm s1 -- --limit 50   then   pnpm s2"
echo "  4. If no on-chain IDL for a program, ask user for IDL JSON → output/<addr>/idl_<addr>.json"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 59)May include surrounding context.

sh

echo ""
echo "Done. Next steps:"
echo "  1. Ask user for Solana address(es); write target_solana_addr.json"
echo "  2. Set HELIUS_API_KEY in .env (recommended)"
echo "  3. pnpm s1 -- --limit 50   then   pnpm s2"
echo "  4. If no on-chain IDL for a program, ask user for IDL JSON → output/<addr>/idl_<addr>.json"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill directs the agent to read environment state, modify local files, and run commands that may access the network, but it declares no explicit tool scope or permission boundaries. That makes the skill harder to audit and increases the chance an agent will overreach into sensitive local resources or execute actions the user did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill tells the agent to automatically create or modify local files, including target_solana_addr.json, as part of a default workflow without an explicit user-facing warning or confirmation. Silent file writes reduce user control and can lead to unintended workspace changes, especially when triggered by loosely phrased requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to scaffold a project and run shell/package-manager commands immediately, but it does not require a clear up-front warning or confirmation. Automatic command execution on a user's machine can have side effects such as dependency installation, script execution, and network access beyond what the user intended.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill persists user-supplied addresses into target_solana_addr.json for reuse across steps, which creates session persistence on disk. While the data is not highly sensitive by itself, persistent state can cause cross-task confusion, stale targeting, and unintended reuse of prior user input in later operations.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

pnpm validate

text

- If `false` / exits non-zero → **stop**, tell the user it is not a valid Solana address, ask for a corrected base58 pubkey. Do **not** write it to `target_solana_addr.json` or call s1.
- `s1`/`s2` also call `isSolanaAddress` via `validateAddresses` in `common.ts` as a second guard.

### 1. Ensure project

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to write a user-provided HELIUS_API_KEY into a local .env file without a strong warning about credential storage risks. Persisting secrets to disk can expose them through source control, backups, logs, or other local tooling if the user is not explicitly informed and protected.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This duplicate persistence finding points to the same behavior: storing user-provided or discovered IDL JSON on disk for subsequent reuse. The main risk is unannounced retention and later unintended reuse rather than direct compromise, but it is still a valid state-persistence concern in an agent skill.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

- Which address(es) were written to `target_solana_addr.json`
- Output paths under `output/<addr>/`
- Whether IDL was auto-saved; if program has **no** on-chain IDL and decode is needed, ask for IDL JSON and write `output/<addr>/idl_<addr>.json`, then re-run `pnpm s2`

## If address is missing

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

This duplicate persistence finding points to the same behavior: storing user-provided or discovered IDL JSON on disk for subsequent reuse. The main risk is unannounced retention and later unintended reuse rather than direct compromise, but it is still a valid state-persistence concern in an agent skill.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

- Which address(es) were written to `target_solana_addr.json`
- Output paths under `output/<addr>/`
- Whether IDL was auto-saved; if program has **no** on-chain IDL and decode is needed, ask for IDL JSON and write `output/<addr>/idl_<addr>.json`, then re-run `pnpm s2`

## If address is missing

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly tells the agent to immediately validate an address, write configuration files, scaffold a project, and run commands as soon as a matching request is seen. That creates side effects on the user's filesystem and may trigger network/package execution without first obtaining explicit confirmation or warning the user, which is unsafe for an auto-triggered skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to create or modify a .env file with HELIUS_API_KEY, including copying from templates or updating existing files, but does not require an explicit credential-handling consent step. Even though it says not to print the key, automatically requesting, storing, or mutating secrets in project files can expose credentials through accidental persistence, workspace leakage, or unintended reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example instructs the agent to initialize a project, change directories, and write configuration files, including creating or updating a .env, without any user-facing warning that the workspace will be modified or that secrets may be stored locally. In an agent setting, silent filesystem changes and secret persistence can violate user expectations and increase the risk of accidental credential exposure or unwanted repository changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script copies HELIUS_API_KEY and optionally SOLANA_RPC_URL from the current environment into a project-local .env file. That persists secrets to disk without explicit consent, widening their exposure to accidental git commits, workspace sharing, backup systems, or later access by other tools; this exceeds the minimal capability needed for simple scaffolding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Writing credentials from environment variables into .env without warning or confirmation silently persists secrets that may otherwise have remained ephemeral. In an agent skill context, this is more dangerous because the agent is instructed to scaffold and proceed immediately, increasing the chance of unattended secret handling in shared workspaces.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The initialization step automatically runs pnpm install or npm install, which executes arbitrary package lifecycle scripts from the scaffolded project and its dependencies. That introduces general code-execution capability during setup, which is not strictly necessary for merely copying templates and can be abused if dependencies or templates are compromised.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples.md:22

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:98

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.zh.md:88