goplus-security-token-scanner
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill identifies a potential surface for indirect prompt injection due to its core functionality of ingesting and processing external blockchain data.
- Ingestion points: The skill retrieves token security reports and contract metadata from the GoPlus Security API (
api.gopluslabs.io) based on user-supplied blockchain addresses. - Boundary markers: The instructions do not define explicit boundary markers or provide the agent with guidance to treat the retrieved API responses as untrusted content.
- Capability inventory: The skill utilizes network capabilities via the
requestslibrary and the@goplus/security-apiclient to fetch remote data. - Sanitization: No evidence of sanitization or filtering of the text content within API responses was found before the data is processed or presented by the agent.
- [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions for installing official dependencies and accessing specific platform builds.
- Recommends the installation of
@goplus/security-apiandweb3via the NPM registry. - Recommends the installation of
goplus-securityandrequestsvia the PyPI registry. - Mentions a premium Windows executable for the GoPlus Security Scanner available from the vendor's official release channels.
Audit Metadata