Solana Analytics Pro 专业Solana分析

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only Solana analysis skill with no included executable code or credential collection, but users should be careful with wallet/portfolio data and any unreviewed referenced scripts or APIs.

This skill appears safe to use as an analysis/reference prompt. Treat its trading signals as informational, verify any missing scripts before running them, and share only the minimum wallet or portfolio data needed.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI04: Agentic Supply Chain Vulnerabilities
Low
What this means

If a user or agent tries to obtain or run similarly named scripts from elsewhere, that code would be unreviewed.

Why it was flagged

The skill documents helper scripts, but the provided package has no code files or install spec, so those scripts are not part of the reviewed artifacts.

Skill content
`scripts/comprehensive_analyzer.py` ... `python3 scripts/comprehensive_analyzer.py --token BONK --depth full`
Recommendation

Do not run or download referenced helper scripts unless their source and contents are verified.

#
ASI03: Identity and Privilege Abuse
Low
What this means

Sharing wallet addresses, holdings files, or transaction histories can expose financial privacy even if no private keys are requested.

Why it was flagged

The skill is designed to work with wallet and portfolio information, which is expected for Solana analytics but can reveal sensitive financial activity.

Skill content
"评估我的 Solana 投资组合" ... "监控某个钱包的动态" ... "导入持仓数据"
Recommendation

Provide only public wallet addresses or redacted portfolio exports, and never share seed phrases, private keys, or signing authority.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Queries involving wallet addresses, tokens, or portfolio details could reveal interests or holdings to external services if used.

Why it was flagged

The skill lists third-party data providers and APIs that are purpose-aligned for crypto analysis, but the artifacts do not define exact data-sharing boundaries.

Skill content
CoinGecko / CoinMarketCap ... Helius ... Solscan / SolanaFM ... Twitter/X API ... LunarCrush ... Santiment
Recommendation

Confirm which providers are used and what data is sent before submitting private portfolio details or API credentials.

#
ASI10: Rogue Agents
Info
What this means

If implemented by other tools, monitoring could continue to consume API access or process wallet-related data until stopped.

Why it was flagged

The skill describes monitoring, alerts, and automated reports, but the provided artifacts contain no mechanism for persistent background operation.

Skill content
"设置巨鲸警报" ... "持续监控 Solana 生态动态" ... "自动化报告"
Recommendation

Use monitoring features only when explicitly requested, with clear targets, duration, notification destination, and a way to stop them.