launch-bnb-token-on-flap
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the
viemlibrary from the official registry during the preflight check. - Evidence:
references/preflight.mdincludes instructions to runnpm install viemif the package is missing. - [DATA_EXFILTRATION]: Transmits token metadata and image files to the official Flap upload endpoint. This is a standard operation for the skill's purpose.
- Evidence:
references/meta-upload.mdusesaxiosto post data tohttps://funcs.flap.sh/api/upload. - [COMMAND_EXECUTION]: Executes local commands to verify the environment and software versions.
- Evidence:
references/preflight.mdusesnode -eto check for the presence of theviempackage. - [INDIRECT_PROMPT_INJECTION]: Processes user-provided text for token metadata fields, which are then used in network requests and transaction data.
- Ingestion points: User-defined values for name, symbol, and description in
SKILL.mdandreferences/meta-upload.md. - Boundary markers: Absent. The skill does not explicitly define delimiters to separate user data from instructions.
- Capability inventory: The skill has file-reading (
fs.readFileSync), network-transmission (axios.post,fetch), and command execution (node -e,npm install) capabilities. - Sanitization: Metadata fields are serialized using standard JSON formatting via
JSON.stringify.
Audit Metadata