opensea
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official and well-known service endpoints including OpenSea (api.opensea.io) and Privy (api.privy.io). These communications are essential for the skill's functionality and use standard authentication patterns.
- [SAFE]: Sensitive data management follows best practices, relying on environment variables for API keys and wallet credentials. The skill explicitly warns against hardcoding secrets or logging sensitive data.
- [SAFE]: The skill uses official vendor packages (@opensea/cli, @opensea/tool-sdk) and provides clear instructions for secure wallet configuration using managed providers like Privy, Turnkey, and Fireblocks.
- [PROMPT_INJECTION]: The skill acknowledges the risk of indirect prompt injection from untrusted NFT metadata in API responses and instructs the agent to treat such data as untrusted, which is a recommended defensive posture.
- [SAFE]: Security-sensitive operations, such as modifying wallet policies, are intentionally excluded from the agent's context and restricted to manual user execution on trusted hardware.
Audit Metadata