arkiv-entity-lifecycle
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill handles data ingested from the Arkiv network, creating a surface for processing potentially untrusted content.
- Ingestion points:
captureSnapshot(references/backup-restore.md) fetches entity payloads and attributes from the chain, whilereplaceReadonlyNote(SKILL.md) reads and parses existing entity JSON. - Boundary markers: The documentation includes detailed instructions on verifying provenance, using digital signatures, and allowlisting creators to prevent the adoption of malicious data.
- Capability inventory: The skill uses
@arkiv-network/sdkcapabilities includingcreateEntity,patchEntity,deleteEntity,changeOwnership, andexecuteBatch(SKILL.md). - Sanitization: The implementation includes schema validation for JSON notes, wallet address equality checks, and explicit type checking for entity attributes.
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@arkiv-network/sdkandviemNode.js packages. It also provides reference links to the official SDK source code on the unpkg.com content delivery network. These are legitimate resources associated with the vendor and established development services.
Audit Metadata