moralis

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references and provides instructions for installing official Moralis libraries and tools from the NPM registry.
  • Evidence: Instructions to install @moralisweb3/api-mcp-server and usage of the moralis SDK in code examples across several reference files.
  • [COMMAND_EXECUTION]: Documentation includes standard command-line instructions for deploying the Moralis MCP (Model Context Protocol) server.
  • Evidence: The file references/features-moralis-cortex.md contains instructions for running npx @moralisweb3/api-mcp-server to initiate the agent-compatible server.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of blockchain data such as NFT metadata and transaction details, which are provided by external users and could theoretically contain malicious instructions.
  • Ingestion points: references/core-wallet-token-nft.md and references/core-web3-data-api.md describe fetching balance and metadata strings from blockchain records.
  • Capability inventory: The skill is scoped to Web3 data retrieval and AI-powered querying via Moralis APIs.
  • Boundary markers: No specific delimiters for untrusted blockchain data are defined in these documentation references.
  • Sanitization: The provided examples do not include explicit sanitization steps for the data retrieved from the blockchain.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 12:14 PM