bankofai-guide
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
@bankofai/agent-walletpackage globally usingnpm install -g. This is a vendor-provided tool required for the skill's core functionality. - [COMMAND_EXECUTION]: The skill executes several shell commands to interact with the wallet CLI, including
agent-wallet list,agent-wallet start, andagent-wallet resolve-address. It also involves passing a generated password as a command-line argument during wallet initialization. - [DYNAMIC_EXECUTION]: The skill runs a local Node.js script (
generate-password.js) using a dynamically determined path from another skill's directory to generate secure credentials for the user. - [INDIRECT_PROMPT_INJECTION]: The skill relies on user responses to navigate between onboarding, setup, and guard flows.
- Ingestion points: User confirmation messages in
SKILL.md(e.g., confirming setup in Section A or C). - Boundary markers: None present; the skill follows natural language cues from the user.
- Capability inventory: Ability to install global NPM packages, execute wallet management commands, and read/write wallet configuration files.
- Sanitization: Not applicable, as user input is used for binary decision branching (yes/no) rather than direct interpolation into shell commands.
Audit Metadata