use-usdc

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted data provided by the user, such as wallet addresses, contract identifiers, and transaction amounts.
  • Ingestion points: User-supplied addresses and transaction parameters are used as inputs for blockchain operations described in SKILL.md.
  • Boundary markers: The skill includes a dedicated 'Security Rules' section that mandates input validation and explicit user confirmation before any write operations are executed.
  • Capability inventory: The skill facilitates balance queries, token transfers, and allowance approvals using external libraries like viem and @solana/kit.
  • Sanitization: It instructs the agent to 'ALWAYS validate all inputs' and 'verify chain ID matches expected environment' to mitigate risks associated with malformed or malicious inputs.
  • [EXTERNAL_DOWNLOADS]: The skill references and downloads official dependencies and resources.
  • Evidence: Instructions to install standard packages including viem, @solana/kit, @solana-program/token, ws, dotenv, and bs58.
  • Evidence: Fetches USDC contract addresses and utilizes faucets from official Circle and Solana domains (developers.circle.com, faucet.circle.com, faucet.solana.com).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 04:29 PM