token-holder-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill scripts fetch token holder information, supply metrics, and security risk data from established service providers including Helius, SolanaTracker, and Birdeye. These network operations are strictly limited to data retrieval necessary for the skill's analytical functions.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it ingests and processes data from external blockchain APIs.
- Ingestion points: Data is retrieved from RPC nodes and external APIs in
scripts/analyze_holders.pyandscripts/concentration_scanner.py. - Boundary markers: The instructions do not define explicit delimiters or warnings for the model to ignore instructions embedded within the API responses.
- Capability inventory: The skill's scripts are restricted to read-only HTTP operations and console output; they do not include dangerous capabilities such as file system modification, shell execution, or credential management.
- Sanitization: The skill implements basic sanitization by parsing JSON responses and performing type conversion (casting to integers and floats) before computing concentration metrics.
Audit Metadata