finance-district
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the fdx CLI to facilitate wallet management, token swaps, and merchant payment configurations.
- [COMMAND_EXECUTION]: Uses curl to perform HTTP requests for merchant discovery and commerce checkouts according to the Universal Commerce Protocol (UCP) and Agentic Checkout Protocol (ACP) specifications.
- [EXTERNAL_DOWNLOADS]: Installs the official @financedistrict/fdx npm package from the public registry to provide the necessary tooling for the agent.
- [PROMPT_INJECTION]: Evaluated for potential indirect prompt injection vulnerabilities. 1. Ingestion points: Merchant discovery and catalog endpoints accessed via curl. 2. Boundary markers: Absent. 3. Capability inventory: Financial transaction signing via fdx and network operations via curl. 4. Sanitization: Risk is mitigated by mandatory user confirmation for all payments and a configurable $500 spending cap.
Audit Metadata