unify-balance

Pass

Audited by Gen Agent Trust Hub on Oct 28, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides standard installation commands for official Circle SDK packages such as @circle-fin/app-kit and @circle-fin/unified-balance-kit along with their respective adapters.
  • [CREDENTIALS_UNSAFE]: The documentation lists environment variable placeholders (EVM_PRIVATE_KEY, SOLANA_PRIVATE_KEY, CIRCLE_API_KEY, and CIRCLE_ENTITY_SECRET) for wallet and API configuration. The skill explicitly forbids hardcoding these values and provides clear security rules for proper secret management and rotation.
  • [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of untrusted data from a user's repository and explicitly instructs the agent to never infer transfer parameters (recipient, amount, etc.) from files, requiring manual user input and explicit confirmation instead.
  • Ingestion points: Repository context as defined in SKILL.md.
  • Boundary markers: Explicit instructional priority and a requirement for manual user confirmation for all financial parameters.
  • Capability inventory: No code execution within the skill itself; it provides instructional code generation for the user to review and run.
  • Sanitization: Not applicable as the skill focus is on instructional constraints rather than direct data processing.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 28, 2026, 02:26 AM