algorand-x402-python
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to install the
x402-avmpackage and its dependencies (such asalgosdk,fastapi, andhttpx) from PyPI. It also references external Algorand node services (AlgoNode) and facilitator URLs (x402.org) required for the protocol's operation. - [INDIRECT_PROMPT_INJECTION]: The skill implements the Bazaar discovery extension, which allows the application to ingest and process metadata (JSON schemas, examples, and resource descriptions) from external x402 facilitators. This ingestion of untrusted data constitutes an attack surface for indirect prompt injection, as a malicious facilitator could provide deceptive metadata to influence the agent's logic or downstream actions.
Audit Metadata