dflow-proof-kyc
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides legitimate instructions for integrating DFlow's identity verification service. All network operations and external resource references trace back to the vendor's own infrastructure.
- [EXTERNAL_DOWNLOADS]: The skill references the
bs58library for cryptographic signing and points to a vendor-owned MCP server athttps://pond.dflow.net/mcpfor extended documentation. These are standard resources for the intended developer use case. - [DATA_EXFILTRATION]: The skill uses a public API endpoint (
proof.dflow.net/verify) to check the verification status of public wallet addresses. No sensitive data access, exfiltration patterns, or hardcoded credentials were found. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied wallet addresses and redirect URIs to construct API calls and deep links. While this creates an ingestion surface for untrusted data, the usage is restricted to standard parameters within the DFlow protocol's integration flow and lacks access to dangerous capabilities.
Audit Metadata