meme-trader
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted token metadata such as names, symbols, and social descriptions fetched from external blockchain data providers.
- Ingestion points: Metadata is retrieved from dexscreener.com, birdeye.so, and other DEX aggregators via the fetch-meme-data.ts script.
- Boundary markers: Absent. External data is interpolated directly into output templates without specific delimiters or instructions to ignore embedded commands.
- Capability inventory: The skill's capabilities are focused on information retrieval (WebFetch, Read) and do not include high-risk tools like sensitive file writing or arbitrary shell execution.
- Sanitization: The script uses Zod for type validation of API responses, ensuring numeric fields are valid, but does not perform content filtering for prompt injection patterns in string fields.
Audit Metadata