User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- AGENT.md:149
Security audit
Slv Grpc Geyser
Security checks across malware telemetry and agentic risk
Overview
This appears to be a legitimate Solana node deployment skill, but it can run powerful unreviewed local SLV playbooks and install system packages, so users should review it carefully before use.
Install only if you are comfortable with an agent managing Solana infrastructure over SSH. Before running deployments, inspect and pin the SLV template directory under ~/.slv/template/, verify the generated inventory and target host, use Ansible --check first, and run scripts/setup.sh only if you accept its local package-manager changes.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
63/63 vendors flagged this skill as clean.
Static analysis
Detected: suspicious.generated_source_template_injection