open-money-agent
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from several sources including Polymarket event titles, token names from discovery APIs, and responses from x402 paid services. Evidence: 1. Ingestion points: references/polymarket.md (market discovery), references/paid-services.md (API responses), references/watches.md (price alerts). 2. Boundary markers: SKILL.md contains explicit instructions to treat input as data and ignore embedded instructions. 3. Capability inventory: Wallet transfers, swaps, arbitrary contract calls (agent call), and state file writes. 4. Sanitization: Relies on LLM-based boundary enforcement as specified in the skill instructions.
- [DYNAMIC_EXECUTION]: The skill provides an 'agent call' command that allows for arbitrary calldata execution against EVM smart contracts. This is a core feature for blockchain interaction but carries risk if the agent is misled into constructing malicious calldata, which is mitigated by the requirement for a transaction preview and manual broadcast.
- [EXTERNAL_DOWNLOADS]: The installation process fetches Node.js binaries from nodejs.org and the @polygonlabs/agent-cli package from the official NPM registry. These resources originate from well-known and vendor-controlled sources.
- [COMMAND_EXECUTION]: The install.md reference contains shell scripts that perform environment detection, directory creation, and CLI initialization. These commands are necessary for the skill setup process and target local workspace directories.
Audit Metadata