bridging-to-abstract
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses the official Abstract API (api.mainnet.abs.xyz) to discover bridge contracts and verify wallet balances using the agw CLI tool. These are expected behaviors for a skill designed to facilitate asset transfers on the Abstract network.\n- [EXTERNAL_DOWNLOADS]: The skill interacts with reputable third-party blockchain bridge providers, including Relay (api.relay.link), LI.FI (li.quest), and deBridge (api.dln.trade). These network operations are limited to fetching transaction quotes and routing information, which is essential for its primary function. The skill explicitly warns against exposing API keys in client-side code, following security best practices.\n- [INDIRECT_PROMPT_INJECTION]: The skill incorporates user-provided data, such as wallet addresses and token amounts, into command templates for curl and agw calls. While this presents a theoretical injection surface, the use case is standard for technical utility skills, and no malicious patterns were observed.\n
- Ingestion points: User-provided values for origin chain, destination chain, asset addresses, and amounts.\n
- Boundary markers: Not explicitly defined in the instruction templates.\n
- Capability inventory: Shell command execution via curl and agw (local wallet management).\n
- Sanitization: The skill relies on standard agent processing and does not specify custom sanitization logic for the variables.
Audit Metadata