launch-bnb-token-on-flap

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches the viem library from the official registry during the preflight check.
  • Evidence: references/preflight.md includes instructions to run npm install viem if the package is missing.
  • [DATA_EXFILTRATION]: Transmits token metadata and image files to the official Flap upload endpoint. This is a standard operation for the skill's purpose.
  • Evidence: references/meta-upload.md uses axios to post data to https://funcs.flap.sh/api/upload.
  • [COMMAND_EXECUTION]: Executes local commands to verify the environment and software versions.
  • Evidence: references/preflight.md uses node -e to check for the presence of the viem package.
  • [INDIRECT_PROMPT_INJECTION]: Processes user-provided text for token metadata fields, which are then used in network requests and transaction data.
  • Ingestion points: User-defined values for name, symbol, and description in SKILL.md and references/meta-upload.md.
  • Boundary markers: Absent. The skill does not explicitly define delimiters to separate user data from instructions.
  • Capability inventory: The skill has file-reading (fs.readFileSync), network-transmission (axios.post, fetch), and command execution (node -e, npm install) capabilities.
  • Sanitization: Metadata fields are serialized using standard JSON formatting via JSON.stringify.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 01:32 AM