use-user-controlled-wallets
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill manages dependencies by installing official, versioned packages (@circle-fin/user-controlled-wallets and @circle-fin/w3s-pw-web-sdk) from the NPM registry. These resources originate from the verified vendor (circlefin) and are essential for the skill's primary functionality.
- [CREDENTIALS_UNSAFE]: The skill significantly reduces credential theft risk by prohibiting the hardcoding of API keys and encryption keys. It mandates the use of environment variables and provides specific guidance on using .gitignore to prevent accidental exposure of secrets in version control.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted data ingestion (such as wallet addresses and transaction amounts) by defining a robust security layer. This includes instructions for server-side input validation and the requirement for explicit user authorization via a challenge-response UI before any sensitive on-chain operations or message signing are executed.
Audit Metadata