Security audit
Security checks for vulnerabilities and agentic risk
This skill is for legitimate Solana node operations, but it relies on high-impact remote administration and unverified external runtime playbooks that users should review carefully before installing.
Install only if you trust the SLV template source and will review the resolved ~/.slv/template playbook path before execution. Use this on intended hosts only, run dry-run/check mode first, avoid production restarts without change approval, and prefer manually installing pinned prerequisites instead of running automatic setup paths.
scripts/setup.sh:88Mutable Remote Installation Script Recommended for Direct Shell Execution
scripts/setup.sh:35Automatic Installation of Unpinned Dependencies
AGENT.md:113Execution of Automatically Selected Playbooks Outside the Audited Skill Package
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grpc-1:
ansible_host: "<server-ip>"
ansible_user: "solv"
ansible_ssh_private_key_file: "~/.ssh/id_rsa"
vars:
# --- RPC Type ---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grpc-1:
ansible_host: "<server-ip>"
ansible_user: "solv"
ansible_ssh_private_key_file: "~/.ssh/id_rsa"
vars:
# --- RPC Type ---
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grpc-1:
ansible_host: "<server-ip>"
ansible_user: "solv"
ansible_ssh_private_key_file: "~/.ssh/id_rsa"
vars:
# --- RPC Type ---
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
brew install ansible
elif [[ "$OS" == "linux" ]]; then
if command -v apt-get &>/dev/null; then
sudo apt-get update && sudo apt-get install -y ansible-core
elif command -v dnf &>/dev/null; then
sudo dnf install -y ansible-core
else
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
warn "SSH agent running but no keys loaded"
echo " → Run: ssh-add ~/.ssh/id_rsa (or your key path)"
fi
elif [[ -f "$HOME/.ssh/id_rsa" ]] || [[ -f "$HOME/.ssh/id_ed25519" ]]; then
info "SSH keys found (agent not running — Ansible will use key files directly)"
else
warn "No SSH keys found"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
warn "SSH agent running but no keys loaded"
echo " → Run: ssh-add ~/.ssh/id_rsa (or your key path)"
fi
elif [[ -f "$HOME/.ssh/id_rsa" ]] || [[ -f "$HOME/.ssh/id_ed25519" ]]; then
info "SSH keys found (agent not running — Ansible will use key files directly)"
else
warn "No SSH keys found"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s http://localhost:8899 -X POST -H "Content-Type: application/json" \
-d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Check if gRPC port is listening (default: 10000)
ss -tlnp | grep ':10000'
# Or use grpcurl if available:
grpcurl -plaintext localhost:10000 list
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}' | jq -r '.result')
# Local slot
LOCAL_SLOT=$(curl -s http://localhost:8899 -X POST -H 'Content-Type: application/json' \
-d '{"jsonrpc":"2.0","id":1,"method":"getSlot"}' | jq -r '.result')
DIFF=$((NETWORK_SLOT - LOCAL_SLOT))
The README explicitly frames the skill as able to deploy, build, and manage Solana gRPC Geyser nodes, including lifecycle actions like stop, restart, and update, but it does not warn that these operations modify remote infrastructure and can interrupt service availability. In an AI-agent skill context, omitting that warning increases the chance a user or agent invokes disruptive actions on production hosts without understanding the operational risk.
The markdown describes commands for full node initialization, start/stop/restart, updates, and Firedancer setup, all of which can change system state, services, and configuration on remote hosts. The file presents these operations as routine usage without an explicit warning that they will modify target servers and may impact running services.
The script automatically installs software and may invoke privileged package-manager commands that modify the host system, but it does not provide a clear upfront warning or require explicit confirmation before doing so. In an agent-skill context, this is risky because users may run the setup helper expecting a passive check, while it can perform system-wide changes and pull packages from external sources.
This line invokes sudo to run apt-get update and install ansible-core, which causes privileged system changes. Even though the goal appears legitimate, embedding sudo execution in a setup script can surprise users, expand blast radius if the script is altered, and normalize running agent-provided code with elevated privileges.
brew install ansible
elif [[ "$OS" == "linux" ]]; then
if command -v apt-get &>/dev/null; then
sudo apt-get update && sudo apt-get install -y ansible-core
elif command -v dnf &>/dev/null; then
sudo dnf install -y ansible-core
else
This line similarly uses sudo with dnf to install ansible-core, performing privileged package installation on Linux systems. In a setup helper distributed as part of an agent skill, unattended elevation is dangerous because users may trust and run it without closely reviewing all system-impacting operations.
if command -v apt-get &>/dev/null; then
sudo apt-get update && sudo apt-get install -y ansible-core
elif command -v dnf &>/dev/null; then
sudo dnf install -y ansible-core
else
error "Cannot auto-install ansible-core. Please install manually: pip3 install ansible-core"
exit 1
The skill instructs users to clone and build privileged infrastructure components from external GitHub repositories based on user-supplied version tags, but it provides no integrity verification, commit pinning, provenance validation, or warning about supply-chain risk. In the context of validator/gRPC node deployment, building unverified third-party code can lead to execution of malicious or compromised source during build or runtime on production servers.
Detected: suspicious.generated_source_template_injection