authenticate-wallet
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch theawalpackage from the npm registry at runtime to perform wallet operations.- [DYNAMIC_EXECUTION]: TheawalCLI package is executed dynamically using thenpxrunner rather than using a pre-installed binary.- [COMMAND_EXECUTION]: The agent is instructed to run Bash commands to check status, initiate login, and verify authentication tokens.- [INDIRECT_PROMPT_INJECTION]: The skill processes external user input which represents an attack surface for indirect prompt injection. \n - Ingestion points: User-provided email, flowId, and OTP strings in SKILL.md commands. \n
- Boundary markers: None present. \n
- Capability inventory: Bash shell execution for the awal CLI tool (restricted by allowed-tools). \n
- Sanitization: No sanitization or validation of the input strings is specified before they are passed to the shell.
Audit Metadata