skills/bofai/skills/bankofai-guide/Gen Agent Trust Hub

bankofai-guide

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @bankofai/agent-wallet package globally using npm install -g. This is a vendor-provided tool required for the skill's core functionality.
  • [COMMAND_EXECUTION]: The skill executes several shell commands to interact with the wallet CLI, including agent-wallet list, agent-wallet start, and agent-wallet resolve-address. It also involves passing a generated password as a command-line argument during wallet initialization.
  • [DYNAMIC_EXECUTION]: The skill runs a local Node.js script (generate-password.js) using a dynamically determined path from another skill's directory to generate secure credentials for the user.
  • [INDIRECT_PROMPT_INJECTION]: The skill relies on user responses to navigate between onboarding, setup, and guard flows.
  • Ingestion points: User confirmation messages in SKILL.md (e.g., confirming setup in Section A or C).
  • Boundary markers: None present; the skill follows natural language cues from the user.
  • Capability inventory: Ability to install global NPM packages, execute wallet management commands, and read/write wallet configuration files.
  • Sanitization: Not applicable, as user input is used for binary decision branching (yes/no) rather than direct interpolation into shell commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:04 PM
Security Audit — agent-trust-hub — bankofai-guide