skills/aeonfun/aeon/tx-explain/Gen Agent Trust Hub

tx-explain

Pass

Audited by Gen Agent Trust Hub on Aug 25, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill interacts exclusively with well-known and trusted infrastructure providers, including the official Base RPC node (mainnet.base.org) and Etherscan (api.etherscan.io). These are standard services for blockchain data retrieval.
  • [DATA_EXPOSURE_AND_EXFILTRATION]: The skill implements secure secret management for the optional Etherscan API key. It uses a specific placeholder system ({ETHERSCAN_API_KEY}) within a specialized wrapper tool (./secretcurl), ensuring the key is never exposed as a plain environment variable, header, or command-line argument.
  • [PROMPT_INJECTION]: The skill explicitly addresses the risk of indirect prompt injection from blockchain data (such as malicious strings in token names or smart contract ABIs). It instructs the agent to treat all decoded calldata and metadata as untrusted and strictly forbids interpolation beyond the quoted transaction hash, which serves as a robust boundary marker.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 25, 2026, 06:39 PM
Security Audit — agent-trust-hub — tx-explain