finance-district-mcp
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill ingests data from external blockchain tools, creating a potential surface for indirect prompt injection.
- Ingestion points: Data returned from financial tools including balances, price movements, and yield strategy descriptions (
SKILL.md). - Boundary markers: Present. The instructions explicitly command the agent to treat tool returns as data only and to disregard any instructions embedded in tool results.
- Capability inventory: Value-moving operations such as transfers, swaps, yield deposits, and x402 payments across EVM, Solana, Bitcoin, and Sui (
SKILL.md). - Sanitization: Relies on negative constraints within the prompt to prevent the execution of instructions found in external responses.
- [COMMAND_EXECUTION]: The skill utilizes local shell scripts to manage its execution environment.
- It invokes
scripts/mcp-oauth-refresh.shto handle authentication token rotation and./notifyto update the operator on task status. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill documentation requires the configuration of a
GH_SECRETS_PAT(GitHub Personal Access Token) to allow the automated workflow to persist rotated OAuth refresh tokens. While this is a functional requirement for the service, it involves the management of high-privilege credentials.
Audit Metadata