ClawHub
Back to skill

Security audit

Solanaprox

Security checks for vulnerabilities and agentic risk

Overview

The skill's main SolanaProx AI proxy behavior is disclosed, but its optional MCP setup executes an unpinned npm package and its security manifest omits another referenced endpoint.

Review before installing. The core proxy behavior is understandable, but run the MCP server only if you trust the npm package and can pin or sandbox it. Expect wallet address, prompts, responses, and usage metadata to be visible to SolanaProx and upstream providers; do not use it for sensitive prompts unless that trust model is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:116
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis
Remediation
View remediation
`, rather than resolving the latest release. - Verify the package's publisher, repository, provenance attestations, and npm integrity metadata before use. - Maintain a lockfile when integrating the package into a project and review dependency changes before updating it. - Prefer installing dependencies during a controlled build phase rather than downloading and executing them dynamically at runtime. - Disable package lifecycle scripts where compatible with the package's operation. - Run the MCP server inside a restricted container or sandbox with: - A non-privileged user. - A minimal environment-variable allowlist. - Read-only or narrowly scoped filesystem access. - Restricted outbound network access. - No access to unrelated credentials or wallet secrets. - Include the package source or a reviewed commit reference in the audited project when practical. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:81
Finding

Unsafe Shell and JSON Construction for User-Controlled Prompts

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest explicitly claims only https://solanaprox.com/ is called, but the skill also contains instructions to POST data to https://aiprox.dev. A false or incomplete security manifest is dangerous because users, agents, or policy engines may rely on it for allowlisting and data-flow decisions, leading to unintended exfiltration or policy bypass.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill transmits the wallet address to a third-party service when checking balance and also later uses it as an HTTP header for paid inference. Although this is the stated purpose of the skill and no private key is sent, it is still an external disclosure of identifier and usage metadata to a proxy service, which creates privacy, tracking, and trust risks if the service is compromised or abusive.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Check Balance

bash
curl -s "https://solanaprox.com/api/balance/$SOLANA_WALLET"

Make AI Request

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users to run an unpinned package via npx, which fetches and executes whatever version is current at runtime. If the package is compromised, a malicious version is published, or the package ownership changes, this can lead to arbitrary code execution on the host running the agent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The security-related documentation is incomplete: the manifest says the skill only calls solanaprox.com, but later instructions include registering agents with aiprox.dev. This kind of disclosure mismatch can cause reviewers or users to underestimate what external services may receive data or metadata, weakening informed consent and security review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.