tonweb
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill introduces a surface for indirect prompt injection by providing methods for the agent to ingest and act upon untrusted data from the TON blockchain.
- Ingestion points: The agent can fetch transaction history (
tonweb.getTransactions), resolve DNS records (tonweb.dns.resolve), and parse NFT/Jetton metadata (NftUtils.parseOffchainUriCell). These external data sources are controlled by arbitrary blockchain users. - Boundary markers: The skill documentation does not provide specific instructions or delimiters to help the agent distinguish between data and instructions when processing string fields from the blockchain (e.g., transaction comments or metadata fields).
- Capability inventory: The skill enables the agent to perform network-based blockchain writes, including sending BOCs (
tonweb.sendBoc) and initiating transfers (wallet.methods.transfer(...).send()). - Sanitization: There is no evidence of sanitization or filtering logic designed to neutralize potential instructions embedded within the blockchain data before the agent processes them.
Audit Metadata