fetch-solana-logs

• Outcome: Review
• Latest audit: Jul 20, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it automatically creates projects, installs packages, stores API keys, and contacts third-party Solana services with too little user confirmation.

Install only if you are comfortable with an agent creating a local project, installing npm packages, storing a Helius key in .env, and sending the queried Solana address to Helius or public RPC. Prefer running it in a dedicated directory, review .env before committing files, and confirm package installation and API-key persistence before letting the workflow run.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read environment variables, access local files, and make networked API calls, but does not declare those permissions explicitly. This weakens security review and consent boundaries because an agent may perform sensitive operations the platform or user did not expect from the metadata alone.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to immediately write configuration files and execute scaffold/fetch commands as soon as a user provides an address, without requiring a clear user-facing confirmation or warning about local side effects. This can cause unintended filesystem changes and network activity from a loosely phrased prompt, increasing the risk of surprise execution and abuse through prompt-triggered operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill handles HELIUS_API_KEY creation and updating in a .env file but does not include an explicit privacy and secret-handling warning to the user before soliciting or storing the credential. Even though it says not to print the key, the workflow still normalizes collecting and persisting a secret without clear consent boundaries, which can lead to accidental disclosure or unsafe storage in the wrong project context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example instructs the agent to initialize a project, create or modify local files, and potentially create a .env file, but it does not clearly warn that these are persistent filesystem changes. In an agent setting that emphasizes 'no extra confirmations,' this can cause unexpected local state changes and credential-bearing file creation without sufficient user awareness.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example shows sending transaction queries over the network using a HELIUS_API_KEY, but does not warn about API-key handling, third-party data exposure, or the privacy implications of querying blockchain activity through an external service. In an automated agent flow, this can lead to silent transmission of user-supplied identifiers and use of sensitive credentials without informed consent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script automatically copies HELIUS_API_KEY and optionally SOLANA_RPC_URL from the caller's environment into a project-local .env file without prompting or warning. That creates a persistent plaintext copy of credentials in the workspace, increasing the chance of accidental disclosure via commits, artifact collection, backups, or later tool access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script automatically runs pnpm install or npm install immediately after scaffolding, which triggers network access and execution of package lifecycle scripts from template dependencies. In an agent skill context, this is risky because it converts a simple file-generation step into implicit external code execution without explicit user approval.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: If the existing log file's last line cannot be parsed, the code truncates the entire file with fs.writeFileSync(fpath, ''). That can destroy previously collected transaction history due to corruption or partial writes, creating integrity and availability risk for local data, especially in an automated agent workflow.

Credential Access

High

• Category: Privilege Escalation

Content

- [ ] isSolanaAddress(addr) === true (pnpm validate)
- [ ] Project ready (existing or init-project.sh)
- [ ] Address(es) written to target_solana_addr.json
- [ ] HELIUS_API_KEY in .env (or public-RPC fallback acknowledged)
- [ ] pnpm s1 (default --limit 50) completed
- [ ] pnpm s2 completed
- [ ] User told output paths / IDL status

• Confidence: 88% confidence
• Finding: The skill directs the agent to obtain and write a HELIUS_API_KEY into a project .env file. Even though it says not to print the key, handling credentials in agent-driven flows increases the risk of accidental disclosure, insecure storage, or reuse in an unintended directory if the working path is manipulated or unclear.

Credential Access

High

• Category: Privilege Escalation

Content

# 2) write config (only after OK)
printf '%s\n' '["DLvbp3sZCdoK6FoGnMdLSP2NZCCZdVfSGHD8KAGazZQH"]' > target_solana_addr.json

# 3) if project already existed, create/update its .env with the supplied key
# HELIUS_API_KEY=<user-provided-key>

# 4) pull + parse

• Confidence: 75% confidence
• Finding: The example explicitly instructs creating or updating a .env file with a user-provided API key, which encourages persistent plaintext storage of credentials on disk. In an agent workflow with automatic execution, this increases the chance of accidental secret exposure through local files, backups, shell history, repository commits, or later tool access.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "packageManager": "pnpm@10.8.1",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",

• Confidence: 96% confidence
• Finding: The dependency uses a caret range, which permits automatic installation of newer minor/patch releases instead of a single immutable version. In a skill that is expected to scaffold and run code immediately, this increases supply-chain risk because a compromised upstream release or breaking change could be pulled at execution time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"packageManager": "pnpm@10.8.1",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",

• Confidence: 96% confidence
• Finding: The dependency uses a caret range, allowing resolution to different package contents over time. Because this skill fetches and parses blockchain data and is intended to be run automatically, unpinned packages enlarge the attack surface for supply-chain compromise or unexpected behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",

• Confidence: 95% confidence
• Finding: Using a ranged dependency means the installed code is not fixed and may change between runs or environments. That creates a low but real supply-chain risk if an upstream package version is malicious, hijacked, or simply incompatible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",

• Confidence: 96% confidence
• Finding: This package is not pinned to an exact version, so future installs may pull updated code without explicit review. In an agent skill that may execute network-facing logic automatically, that weakens supply-chain control and could enable malicious or unstable dependency updates.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",

• Confidence: 94% confidence
• Finding: A caret version allows non-deterministic dependency resolution across time and machines. While not an immediate exploit by itself, it increases exposure to upstream package compromise and makes builds less auditable.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",

• Confidence: 94% confidence
• Finding: The package range allows different code to be installed later than what was originally tested. This is a classic low-severity supply-chain hygiene issue that matters more for skills that are automatically run by agents.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"

• Confidence: 94% confidence
• Finding: Because the dependency is version-ranged, the project does not guarantee the same package contents on every install. That creates a low-severity but valid risk of supply-chain drift or malicious upstream updates.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },

• Confidence: 94% confidence
• Finding: The dotenv dependency is not pinned exactly, so installation may vary over time. In an automation context, this reduces reproducibility and slightly increases the chance of consuming a compromised or breaking upstream release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },
  "devDependencies": {

• Confidence: 94% confidence
• Finding: This dependency uses a caret range, which weakens control over the exact code executed in the environment. That is a legitimate low-severity supply-chain concern, especially for code that may be scaffolded and run automatically.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },
  "devDependencies": {
    "@types/node": "^26.1.1",

• Confidence: 94% confidence
• Finding: A non-exact version allows future installs to consume different package code than originally reviewed. This is dangerous because compromised upstream releases can propagate into automated agent workflows without any source changes in the skill itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"stream-json": "^1.9.1"
  },
  "devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }

• Confidence: 91% confidence
• Finding: Even though this is a devDependency, an unpinned version still undermines reproducibility and can affect build or execution tooling. Toolchain compromise is a recognized supply-chain risk, though generally lower impact than direct runtime dependency compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }
}

• Confidence: 93% confidence
• Finding: tsx is an execution tool, and leaving it version-ranged means the environment may run different toolchain code over time. In a skill whose scripts are intended to be executed directly, this slightly increases supply-chain and build/runtime integrity risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }
}

• Confidence: 92% confidence
• Finding: A ranged TypeScript version can introduce non-deterministic compiler/toolchain behavior and supply-chain drift. While not typically directly exploitable alone, it is still a valid low-severity dependency integrity issue.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples.md:22

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:98

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.zh.md:88