cryptorefills-x402
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external API endpoints, including brand catalogs and payment requirement headers (PAYMENT-REQUIRED), which serves as an ingestion point for untrusted data that could influence agent behavior.
- Ingestion points: Data retrieved from x402.cryptorefills.com and solana.x402.cryptorefills.com via REST API calls and response headers.
- Capability inventory: The skill allows the agent to perform network requests and sign blockchain transactions (EIP-712 for Base and VersionedTransactions for Solana), which can lead to financial asset transfers.
- Boundary markers: The skill documentation (SKILL.md and references/protocol.md) mandates the use of an X-Payment-Required-Signature (JWS) to authenticate payment parameters before any signing occurs.
- Sanitization: The skill provides instructions for the agent to verify transaction amounts against user-defined session limits and to validate the cryptographic attestation's issuer, session ID, and payload hash.
Audit Metadata