fund
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to execute
npx awal@latestfor wallet operations. This command fetches the package from the public NPM registry at runtime. - [REMOTE_CODE_EXECUTION]: By utilizing
npxto fetch and run a package directly from an external registry, the skill performs remote code execution. - [EXTERNAL_DOWNLOADS]: The use of the
@latestversion identifier instead of a pinned, specific version number prevents integrity verification. This makes the environment susceptible to supply chain attacks where a compromised update to the package would be automatically downloaded and executed by the agent.
Audit Metadata