jupiter
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references several external packages and libraries required for Solana development, including
helius-mcp,helius-sdk,helius-laserstream, and various Jupiter SDKs (@jup-ag/lend,@jup-ag/plugin). These are vendor-provided or well-known ecosystem libraries. - [COMMAND_EXECUTION]: The documentation includes instructions for using command-line tools such as
npxto initialize the Helius MCP server (npx helius-mcp@2.2.0) and thehelius-clifor account management and signup flows. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing external data, including user-supplied token mints, transaction amounts, and real-time blockchain data from Helius and Jupiter APIs. While this creates a potential attack surface for indirect prompt injection, the skill includes instructions for data validation and follows standard development patterns.
- [SAFE]: The skill explicitly advises against hardcoding API keys, recommends using environment variables, and provides human-readable transaction parsing patterns to enhance user oversight.
Audit Metadata