blocknative-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill is properly scoped to read-only gas intelligence operations and adheres to security best practices.\n- [EXTERNAL_DOWNLOADS]: Fetches a curated OpenAPI configuration from the vendor's official GitHub repository (holon-run/uxc) to define API operations. This is a standard and expected configuration step for this skill author.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes gas price and fee predictions from api.blocknative.com, which is an external data source.\n
- Ingestion points: api.blocknative.com via uxc tool (SKILL.md).\n
- Boundary markers: The skill instructs the agent to use the JSON output envelope rather than plain text, which helps in structured parsing.\n
- Capability inventory: The skill is restricted to making network GET requests (SKILL.md, blocknative-gas.openapi.json).\n
- Sanitization: Instructions mandate parsing stable fields and using jq for data handling, minimizing the risk of processing malformed or malicious responses.
Audit Metadata