elfa-api
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the bash_tool to execute curl commands for interacting with the Elfa API at https://api.elfa.ai. This is the primary intended function of the skill.
- [CREDENTIALS_UNSAFE]: The skill correctly identifies ELFA_API_KEY as a sensitive credential and instructs the agent to retrieve it from environment variables rather than asking the user to provide it in plain text. It also includes warnings to mask keys in output and advises users to rotate keys if accidentally shared.
- [EXTERNAL_DOWNLOADS]: The skill provides code examples that suggest the use of external Node.js packages such as @x402/fetch and viem. These are standard libraries for the functionality described (blockchain interactions and payment protocols) and are presented as integration examples for the user rather than automated installations by the agent.
Audit Metadata