github-vesting
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill demonstrates a strong security posture with no malicious patterns detected. It provides explicit documentation and mandatory safety checks for all sensitive operations.
- [COMMAND_EXECUTION]: The skill initiates blockchain transactions (approve and lock) on the Base network via the Bankr wallet API. It mitigates transaction risks by requiring the agent to validate every field of the transaction calldata (recipient address, function selector, and amount) against a pinned configuration in
known-escrow.jsonand the user's stated intent before submission. - [PROMPT_INJECTION]: The skill proactively manages indirect prompt injection risks by instructing the agent in
references/RESPONSE-SAFETY.mdto treat API-provided strings (such asreplyTextortweetReply) as untrusted data. It mandates that the agent format all user-facing responses locally using structured JSON fields. - [EXTERNAL_DOWNLOADS]: The skill communicates with the service API at
api.proofofdev.xyzand the vendor's wallet API atapi.bankr.bot. These communications are restricted to allowlisted hosts, and the skill includes rigorous host and path validation for all URLs presented to the user.
Audit Metadata