utilia-solana-preflight
Warn
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx -y utilia-solana-agent, which fetches and executes the latest version of a third-party package from the NPM registry at runtime. - [COMMAND_EXECUTION]: Multiple shell commands are utilized to perform blockchain analysis, fee estimation, and transaction simulation using the
npxutility. - [CREDENTIALS_UNSAFE]: The skill requires users to provide a Solana private key or a path to a keypair via environment variables (
SOLANA_PRIVATE_KEYorSOLANA_KEYPAIR_PATH). Although the documentation includes warnings about using low-balance wallets, these credentials are exposed to the executed Node.js package. - [REMOTE_CODE_EXECUTION]: Executing unversioned third-party code via
npxconstitutes a remote code execution vector, as the package's behavior can be changed by the maintainer at any time without user awareness.
Audit Metadata