hodlmm-pulse
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
bunto execute the TypeScript logic as defined in theSKILL.mdentry point and command instructions. - [EXTERNAL_DOWNLOADS]: The skill fetches market data from
bff.bitflowapis.finance. This is an official domain for Bitflow Finance and is required for the skill's primary function of tracking pool fees and volume. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Bitflow APIs. This represents an attack surface for indirect prompt injection; however, the data consists of structured numerical fields (prices, fees, volume) used for calculations rather than direct prompt interpolation. While explicit boundary markers are not used, the specific data types and usage limit the exploitation risk.
Audit Metadata