blofin-setup
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to download the vendor's official
blofin-mcppackage via npm and clones the official repository fromgithub.com/blofin/blofin-mcp.gitfor local installation. - [COMMAND_EXECUTION]: Provides instructions to run shell commands for global and local package installation (
npm install,npm run build) and for cloning the source code viagit. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data from the BloFin exchange APIs into the agent's context, which represents a theoretical vulnerability surface.
- Ingestion points: API responses from tools such as
get_tickers,get_balance, andget_apikey_infoinSKILL.md. - Boundary markers: No specific delimiters or "ignore embedded instructions" warnings are defined in this setup guide.
- Capability inventory: The configured MCP server includes capabilities to place trades and manage account funds.
- Sanitization: No explicit sanitization or validation of the API data is described in the skill instructions.
Audit Metadata