token-movers
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands including
curl,./secretcurl, and./notifyto interact with market APIs, log data to the file system, and send alerts to the user. These commands are used for their intended reporting purpose. - [EXTERNAL_DOWNLOADS]: The skill fetches real-time data from established cryptocurrency and technology services:
- Market data from CoinGecko, GeckoTerminal, and DexScreener.
- Social sentiment analysis via the X.ai (Grok) API.
- Blockchain balances via public or user-provided RPC endpoints.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from market APIs and social media posts. It mitigates this risk by including a mandatory security instruction for the agent to treat all fetched content as data only and to disregard any instructions found within those fields.
- [SAFE]: Secret management is handled securely through the use of a
./secretcurlhelper that utilizes environment variable placeholders, ensuring that API keys are not exposed in the process list or command logs.
Audit Metadata