unify-balance
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard installation commands for official Circle SDK packages such as
@circle-fin/app-kitand@circle-fin/unified-balance-kitalong with their respective adapters. - [CREDENTIALS_UNSAFE]: The documentation lists environment variable placeholders (
EVM_PRIVATE_KEY,SOLANA_PRIVATE_KEY,CIRCLE_API_KEY, andCIRCLE_ENTITY_SECRET) for wallet and API configuration. The skill explicitly forbids hardcoding these values and provides clear security rules for proper secret management and rotation. - [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of untrusted data from a user's repository and explicitly instructs the agent to never infer transfer parameters (recipient, amount, etc.) from files, requiring manual user input and explicit confirmation instead.
- Ingestion points: Repository context as defined in SKILL.md.
- Boundary markers: Explicit instructional priority and a requirement for manual user confirmation for all financial parameters.
- Capability inventory: No code execution within the skill itself; it provides instructional code generation for the user to review and run.
- Sanitization: Not applicable as the skill focus is on instructional constraints rather than direct data processing.
Audit Metadata