skills/aeonfun/aeon/token-movers/Gen Agent Trust Hub

token-movers

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands including curl, ./secretcurl, and ./notify to interact with market APIs, log data to the file system, and send alerts to the user. These commands are used for their intended reporting purpose.
  • [EXTERNAL_DOWNLOADS]: The skill fetches real-time data from established cryptocurrency and technology services:
  • Market data from CoinGecko, GeckoTerminal, and DexScreener.
  • Social sentiment analysis via the X.ai (Grok) API.
  • Blockchain balances via public or user-provided RPC endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from market APIs and social media posts. It mitigates this risk by including a mandatory security instruction for the agent to treat all fetched content as data only and to disregard any instructions found within those fields.
  • [SAFE]: Secret management is handled securely through the use of a ./secretcurl helper that utilizes environment variable placeholders, ensuring that API keys are not exposed in the process list or command logs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:35 PM