recover-eco-funds
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The recovery scripts dynamically import the Circle CLI runtime from a user-provided directory path. This allows the skill to utilize existing authenticated sessions and signing logic.
- [DATA_EXPOSURE]: The skill uses the
circleCLI to retrieve sensitive wallet information, including balances and transaction history, which is necessary to identify and verify recoverable assets. - [REMOTE_CODE_EXECUTION]: The skill uses
curlto fetch intent and deposit data from official Eco protocol endpoints. These operations are limited to data retrieval and do not involve piped execution or other dangerous execution patterns. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources and blockchain events. It mitigates injection risks by implementing technical validation steps, such as recomputing intent hashes and verifying signer addresses against API-reported owner data.
Audit Metadata