tres-asset-balance-validation
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- Secure Secret Handling: The skill prioritizes user privacy and security by instructing the agent to retrieve the DeBank API key from protected configuration settings rather than prompting for it in the chat. This reduces the risk of accidental credential exposure.- Mitigation of Command Injection: By utilizing specific curl flags such as --data-urlencode, the skill ensures that external variables like wallet addresses are processed strictly as data. This follows industry best practices to prevent the execution of arbitrary shell commands.- External Data Processing: The skill aggregates financial data from TRES Finance and DeBank APIs to generate comparative reports.
- Ingestion points: Financial data is pulled from TRES via GraphQL and from DeBank via REST API endpoints (SKILL.md).
- Capability inventory: The agent uses command-line tools for networking and file-writing tools to create HTML and PDF artifacts (SKILL.md).
- Sanitization: While the skill focuses on numerical formatting and visual layout, the processing of external API data for report generation is a standard operation where the agent should handle asset names as plain text.- Controlled Network Activity: The skill establishes connections to DeBank's official API to facilitate the balance cross-check. This is a standard and necessary component of the skill's intended operation for on-chain data verification.
Audit Metadata