codevasp-travel-rule-guide
Warn
Audited by Gen Agent Trust Hub on Nov 10, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: Hardcoded API access keys and secret keys were identified in the implementation samples. Specifically,
references/samples/java/src/main/java/com/codevasp/BithumbGetNetwork.javacontains a plaintext access key and a base64-encoded secret key for the Bithumb exchange. While intended as placeholders for integration testing, hardcoding secrets is an insecure practice. - [EXTERNAL_DOWNLOADS]: The skill is configured to fetch documentation, API references, and JSON schemas from
docs.codevasp.comand GitHub repositories under thecodevasp-laborganization. These are official author resources consistent with the skill's purpose. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided JSON payloads (IVMS101 data) for validation and integration assistance. As the agent has network access capabilities (
curl), there is an attack surface for indirect injection if a malicious payload is supplied, although the skill instructions emphasize validation against official schemas and documentation. - [DYNAMIC_EXECUTION]: The skill bundles pre-compiled Java binary files (
.class) and a Java archive (gradle-wrapper.jar). These binary artifacts cannot be audited via static analysis and represent executable content shipped with the skill.
Audit Metadata