onair-shoutout
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill requires access to a blockchain private key (via the
GMFARCASTER_PRIVATE_KEYenvironment variable or a local file path) to sign transactions for shoutout payments. - [EXTERNAL_DOWNLOADS]: The installation process requires downloading Python dependencies (
x402,eth-account,requests) from external package registries during the setup phase. - [DATA_EXFILTRATION]: The skill transmits user-provided content, including sponsor names and message text, to an external API endpoint (
gateway.gmfarcaster.com) for processing. - [COMMAND_EXECUTION]: The skill relies on the execution of a Python script (
scripts/request.py) to handle sensitive operations including local payment signing and API communication. - [PROMPT_INJECTION]: The skill processes untrusted text from the user meant for live broadcast, creating a surface for indirect prompt injection. The skill includes instructional safeguards requiring the agent to preview the content and obtain explicit user approval to mitigate risks of automated execution.
Audit Metadata