pay-via-agent-wallet
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from an external, third-party marketplace, which represents an untrusted input source.\n
- Ingestion points: Data is retrieved from the marketplace via
circle services searchand directcurlrequests to seller-provided URLs (SKILL.md).\n - Boundary markers: The instructions do not mandate the use of delimiters or 'ignore' warnings to separate this external content from the system prompt.\n
- Capability inventory: The agent is granted capabilities for financial transactions (
circle services pay), wallet management (circle wallet), and arbitrary network requests (curl) (SKILL.md).\n - Sanitization: The skill provides comprehensive validation rules, including regex patterns for header names and printable ASCII checks for values, which must be applied before data is used in commands.\n- [COMMAND_EXECUTION]: The skill's workflow involves constructing shell commands using dynamic strings provided by the external services marketplace (e.g., URLs, headers, and HTTP methods). While validation is instructed, this design inherently exposes a command injection surface if sanitization is incomplete or bypassed.\n- [PROMPT_INJECTION]: The skill includes instructions that encourage the agent to bypass its internal task-rejection logic (e.g., "Search before declining") and to activate the skill even without explicit user mention, which modifies the agent's default safety behavior regarding capability limits.
Audit Metadata