use-usdc
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data provided by the user, such as wallet addresses, contract identifiers, and transaction amounts.
- Ingestion points: User-supplied addresses and transaction parameters are used as inputs for blockchain operations described in
SKILL.md. - Boundary markers: The skill includes a dedicated 'Security Rules' section that mandates input validation and explicit user confirmation before any write operations are executed.
- Capability inventory: The skill facilitates balance queries, token transfers, and allowance approvals using external libraries like
viemand@solana/kit. - Sanitization: It instructs the agent to 'ALWAYS validate all inputs' and 'verify chain ID matches expected environment' to mitigate risks associated with malformed or malicious inputs.
- [EXTERNAL_DOWNLOADS]: The skill references and downloads official dependencies and resources.
- Evidence: Instructions to install standard packages including
viem,@solana/kit,@solana-program/token,ws,dotenv, andbs58. - Evidence: Fetches USDC contract addresses and utilizes faucets from official Circle and Solana domains (
developers.circle.com,faucet.circle.com,faucet.solana.com).
Audit Metadata