ordinals
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The get-inscription command fetches content directly from the Bitcoin blockchain, which is untrusted data that could contain malicious instructions.\n
- Ingestion points: ordinals.ts retrieves data via InscriptionParser.getInscriptionsFromTx.\n
- Capability inventory: The skill has the ability to sign/broadcast transactions and access wallet addresses, posing a risk if the agent is influenced by fetched content.\n
- Sanitization: Content is returned as JSON and bodyText is truncated to 1000 characters, but no validation or safety filtering is performed on the content itself.\n
- Boundary markers: There are no explicit delimiters or instructions telling the agent to treat the fetched blockchain content as untrusted.\n- [COMMAND_EXECUTION]: The skill enables the agent to perform write operations on the Bitcoin network, such as inscribing and transferring assets.\n
- Evidence: The subcommands inscribe, inscribe-reveal, and transfer-inscription utilize local private keys to sign transactions that are then broadcast to the network.\n- [EXTERNAL_DOWNLOADS]: The skill makes network requests to external Bitcoin indexing and mempool services.\n
- Evidence: Interactions with mempool.space for fee estimation and transaction broadcasting, and Unisat for inscription UTXO lookups. These are established services within the Bitcoin ecosystem.
Audit Metadata