sleuth-ai
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a service manifest from 'https://app.sleuthagent.ai/x402/openai-bnkr.json'. This operation is documented with strict security invariants, including host and path pinning, to ensure the integrity of the endpoint discovery process.
- [COMMAND_EXECUTION]: The skill utilizes the 'bankr' CLI tool to perform payment-enabled API calls to 'https://x402.bankr.bot'. The instructions include detailed verification steps for the agent to perform on the URL and payment parameters before execution, mitigating risks of malicious redirection.
- [DATA_EXFILTRATION]: The skill naturally transmits investigation targets (such as wallet addresses) to external servers. The instructions include a specific privacy section requiring the agent to obtain user confirmation before sending any sensitive identifiers.
- [REMOTE_CODE_EXECUTION]: While the skill interacts with external endpoints, it explicitly classifies all response data as untrusted and forbids the agent from allowing response content to trigger any state changes, tool calls, or software installations.
Audit Metadata