bitcoin-js
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation contains hardcoded Wallet Import Format (WIF) strings in examples (e.g.,
KwDiBf...inreferences/core-payments-addresses.mdandL2uPYX...inreferences/core-psbt.md). These are recognized as standard, public test vectors used in official library documentation for illustrative purposes and do not represent active credentials. - [INDIRECT_PROMPT_INJECTION]: The skill provides guidelines for agents to process Bitcoin transactions using data potentially supplied by users (e.g., addresses, hex strings).
- Ingestion points: Data enters the agent context via address and script input instructions described in
references/core-payments-addresses.mdandreferences/core-psbt.md. - Boundary markers: Explicit security warnings and verification instructions are provided in
references/best-practices-security.mdto prevent accidental execution of malicious transaction data. - Capability inventory: No scripts or executable files are included with the skill; it is documentation-only.
- Sanitization: The skill mandates manual human verification of all transaction details (amounts, addresses, fees) before broadcast.
Audit Metadata