ClawHub
Back to skill

Security audit

fetch-solana-logs

Security checks across malware telemetry and agentic risk

Overview

The skill does what it claims, but it automatically creates projects, installs packages, stores API keys, and contacts third-party Solana services with too little user confirmation.

Install only if you are comfortable with an agent creating a local project, installing npm packages, storing a Helius key in .env, and sending the queried Solana address to Helius or public RPC. Prefer running it in a dedicated directory, review .env before committing files, and confirm package installation and API-key persistence before letting the workflow run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (23)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to read environment variables, access local files, and make networked API calls, but does not declare those permissions explicitly. This weakens security review and consent boundaries because an agent may perform sensitive operations the platform or user did not expect from the metadata alone.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly instructs the agent to immediately write configuration files and execute scaffold/fetch commands as soon as a user provides an address, without requiring a clear user-facing confirmation or warning about local side effects. This can cause unintended filesystem changes and network activity from a loosely phrased prompt, increasing the risk of surprise execution and abuse through prompt-triggered operations.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill handles HELIUS_API_KEY creation and updating in a .env file but does not include an explicit privacy and secret-handling warning to the user before soliciting or storing the credential. Even though it says not to print the key, the workflow still normalizes collecting and persisting a secret without clear consent boundaries, which can lead to accidental disclosure or unsafe storage in the wrong project context.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The example instructs the agent to initialize a project, create or modify local files, and potentially create a .env file, but it does not clearly warn that these are persistent filesystem changes. In an agent setting that emphasizes 'no extra confirmations,' this can cause unexpected local state changes and credential-bearing file creation without sufficient user awareness.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The example shows sending transaction queries over the network using a HELIUS_API_KEY, but does not warn about API-key handling, third-party data exposure, or the privacy implications of querying blockchain activity through an external service. In an automated agent flow, this can lead to silent transmission of user-supplied identifiers and use of sensitive credentials without informed consent.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script automatically copies HELIUS_API_KEY and optionally SOLANA_RPC_URL from the caller's environment into a project-local .env file without prompting or warning. That creates a persistent plaintext copy of credentials in the workspace, increasing the chance of accidental disclosure via commits, artifact collection, backups, or later tool access.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script automatically runs pnpm install or npm install immediately after scaffolding, which triggers network access and execution of package lifecycle scripts from template dependencies. In an agent skill context, this is risky because it converts a simple file-generation step into implicit external code execution without explicit user approval.

Missing User Warnings

Medium
Confidence
74% confidence
Finding
If the existing log file's last line cannot be parsed, the code truncates the entire file with fs.writeFileSync(fpath, ''). That can destroy previously collected transaction history due to corruption or partial writes, creating integrity and availability risk for local data, especially in an automated agent workflow.

Credential Access

High
Category
Privilege Escalation
Content
- [ ] isSolanaAddress(addr) === true (pnpm validate)
- [ ] Project ready (existing or init-project.sh)
- [ ] Address(es) written to target_solana_addr.json
- [ ] HELIUS_API_KEY in .env (or public-RPC fallback acknowledged)
- [ ] pnpm s1 (default --limit 50) completed
- [ ] pnpm s2 completed
- [ ] User told output paths / IDL status
Confidence
88% confidence
Finding
.env

Credential Access

High
Category
Privilege Escalation
Content
# 2) write config (only after OK)
printf '%s\n' '["DLvbp3sZCdoK6FoGnMdLSP2NZCCZdVfSGHD8KAGazZQH"]' > target_solana_addr.json

# 3) if project already existed, create/update its .env with the supplied key
# HELIUS_API_KEY=<user-provided-key>

# 4) pull + parse
Confidence
75% confidence
Finding
.env

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "ISC",
  "packageManager": "pnpm@10.8.1",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
Confidence
96% confidence
Finding
"@coral-xyz/anchor": "^0.32.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"packageManager": "pnpm@10.8.1",
  "dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
Confidence
96% confidence
Finding
"@solana/web3.js": "^1.98.4"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
Confidence
95% confidence
Finding
"JSONStream": "^1.3.5"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@coral-xyz/anchor": "^0.32.1",
    "@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
Confidence
96% confidence
Finding
"axios": "^1.18.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@solana/web3.js": "^1.98.4",
    "JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
Confidence
94% confidence
Finding
"bs58": "^6.0.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"JSONStream": "^1.3.5",
    "axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
Confidence
94% confidence
Finding
"dayjs": "^1.11.21"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"axios": "^1.18.1",
    "bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
Confidence
94% confidence
Finding
"decimal.js": "^10.6.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"bs58": "^6.0.0",
    "dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },
Confidence
94% confidence
Finding
"dotenv": "^17.4.2"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dayjs": "^1.11.21",
    "decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },
  "devDependencies": {
Confidence
94% confidence
Finding
"stream-chain": "^3.4.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"decimal.js": "^10.6.0",
    "dotenv": "^17.4.2",
    "stream-chain": "^3.4.0",
    "stream-json": "^1.9.1"
  },
  "devDependencies": {
    "@types/node": "^26.1.1",
Confidence
94% confidence
Finding
"stream-json": "^1.9.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"stream-json": "^1.9.1"
  },
  "devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }
Confidence
91% confidence
Finding
"@types/node": "^26.1.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }
}
Confidence
93% confidence
Finding
"tsx": "^4.23.1"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"devDependencies": {
    "@types/node": "^26.1.1",
    "tsx": "^4.23.1",
    "typescript": "^7.0.2"
  }
}
Confidence
92% confidence
Finding
"typescript": "^7.0.2"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
examples.md:22

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:98

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.zh.md:88