alby-bitcoin-builder
Pass
Audited by Gen Agent Trust Hub on Jun 2, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill documentation provides security instructions regarding Nostr Wallet Connect (NWC) connection strings, which are sensitive credentials. It includes explicit directives for the agent to avoid sharing or logging these secrets (Evidence: references/nwc-client/nwc-client.md).
- [INDIRECT_PROMPT_INJECTION]: The skill designs applications that ingest untrusted data from external sources. (1) Ingestion points: transaction descriptions in references/nwc-client/notifications.md. (2) Boundary markers: Absent. (3) Capability inventory: Code generation for file and network operations. (4) Sanitization: Not provided in examples for processing transaction metadata.
- [EXTERNAL_DOWNLOADS]: The skill recommends installing vendor-specific libraries from the @getalby namespace and community types. It also utilizes a dedicated testing service at faucet.nwc.dev for creating isolated wallet environments (Evidence: references/testing-wallets.md).
Audit Metadata