moralis
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for installing official Moralis libraries and tools from the NPM registry.
- Evidence: Instructions to install
@moralisweb3/api-mcp-serverand usage of themoralisSDK in code examples across several reference files. - [COMMAND_EXECUTION]: Documentation includes standard command-line instructions for deploying the Moralis MCP (Model Context Protocol) server.
- Evidence: The file
references/features-moralis-cortex.mdcontains instructions for runningnpx @moralisweb3/api-mcp-serverto initiate the agent-compatible server. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of blockchain data such as NFT metadata and transaction details, which are provided by external users and could theoretically contain malicious instructions.
- Ingestion points:
references/core-wallet-token-nft.mdandreferences/core-web3-data-api.mddescribe fetching balance and metadata strings from blockchain records. - Capability inventory: The skill is scoped to Web3 data retrieval and AI-powered querying via Moralis APIs.
- Boundary markers: No specific delimiters for untrusted blockchain data are defined in these documentation references.
- Sanitization: The provided examples do not include explicit sanitization steps for the data retrieved from the blockchain.
Audit Metadata