cournot

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes an external command-line tool to handle wallet operations and signatures.
  • The scripts/cournot-client.mjs file uses spawnSync to invoke a wallet CLI (defaulting to baw, the Binance Agentic Wallet).
  • It includes a walletInvocation helper that manages command construction and argument escaping for both Unix-like and Windows environments, utilizing cmd.exe /c on Windows with specific character escaping.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes structured data and natural language evidence (basis data) from the Cournot API, which represents an attack surface for indirect prompt injection.
  • Ingestion points: Data enters the agent's context through API responses from https://interface.cournot.ai and https://dev-interface.cournot.ai, processed in scripts/account-flow.mjs and formatted in references/response-format.md.
  • Boundary markers: The references/response-format.md file provides explicit instructions to treat API results as authoritative and prevents the agent from supplementing the output with external or invented information. It also mandates escaping markdown delimiters like | when rendering tables.
  • Capability inventory: The skill has the ability to execute CLI commands (spawnSync), perform network requests (fetch), and write to the local filesystem (writeFileSync for credentials and payment intents).
  • Sanitization: The scripts/account-flow.mjs file includes a sanitize function that redacts sensitive fields (such as api_key, signature, and privateKey) from tool outputs and logs.
  • [EXTERNAL_DOWNLOADS]: The skill documentation includes instructions for installing a trusted external dependency.
  • references/payment.md provides a command to install the binance-agentic-wallet skill from the official Binance skills repository using the platform's skill management tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 11:35 AM