hodlmm-bin-guardian
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external APIs (Bitflow and Hiro) and user-supplied wallet addresses. It includes robust mitigations: it validates wallet addresses with a strict regular expression (
^SP[A-Z0-9]{30,}$), enforces a structured JSON output contract, and limits its capabilities to network reads and local state management. - [PERSISTENCE]: The script maintains a state file at
~/.hodlmm-guardian-state.jsonto track rebalance timestamps. This mechanism is used solely to enforce the 4-hour rebalance cooldown safety rule between sessions. - [EXTERNAL_DOWNLOADS]: The skill fetches pool and price data from well-known service providers (Bitflow Finance and Hiro). These downloads are restricted to retrieving configuration and status data necessary for health monitoring and do not include executable code or scripts.
- [COMMAND_EXECUTION]: The skill is a CLI tool designed to be run via the
bunruntime. It performs network calls and file system operations using standard libraries for its stated monitoring purpose without attempting to execute unauthorized shell commands.
Audit Metadata