wormhole
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The skill consists entirely of documentation (Markdown files) and does not include any executable scripts, binaries, or active configuration files.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processes for handling external, untrusted data payloads from cross-chain messages (VAAs), notably in references/core-vaa-and-messaging.md and references/core-token-bridge.md. It correctly frames this as a security boundary, emphasizing emitter authorization and signature verification as key defenses. Since the skill contains no code, it lacks exploitable capabilities to process these payloads automatically. Sanitization is addressed via UTF-8 validation for token metadata in references/best-practices-contract-integration.md.
- [EXTERNAL_DOWNLOADS]: The documentation references official repositories and the @wormhole-foundation/sdk. These are standard informational links for protocol integration and do not involve unauthorized or automated remote execution.
Audit Metadata