pay-for-service
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npx awal@latestin its allowed-tools and instructions, which downloads and executes the latest version of theawalpackage from the NPM registry at runtime. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: The agent processes the output/response from
npx awal@latest x402 pay <url>, which originates from external, potentially untrusted API providers. - Boundary markers: The skill does not provide instructions to wrap or delimit API output to prevent the agent from following instructions embedded in the response.
- Capability inventory: The agent has the ability to execute specific shell commands via the
awalCLI, including making further paid requests and checking wallet balances. - Sanitization: There is no evidence of sanitization or validation of the content returned from the external API calls before it is added to the agent's context.
- [DATA_EXFILTRATION]: The
x402 paycommand includes options for custom headers (-h) and data payloads (-d). If an agent is manipulated via prompt injection, it could potentially be instructed to include local credentials, environment variables, or sensitive files in these outgoing requests to an attacker-controlled URL.
Audit Metadata