blockscout-openapi-skill
Pass
Audited by Gen Agent Trust Hub on Mar 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a curated OpenAPI schema from the author's GitHub repository (holon-run/uxc) to define API operations for the uxc tool.- [COMMAND_EXECUTION]: Uses the uxc tool to create local command aliases and execute HTTP requests against Blockscout REST API endpoints for blockchain data retrieval.- [PROMPT_INJECTION]: The skill processes untrusted data from external Blockscout API endpoints (e.g., eth.blockscout.com), creating a surface for potential indirect prompt injection.
- Ingestion points: JSON responses from the Blockscout /api/v2 endpoints via blockscout-openapi-cli.
- Boundary markers: Not explicitly defined in the prompt logic; the skill relies on the agent parsing the JSON envelope.
- Capability inventory: Execution of uxc commands and associated CLI aliases.
- Sanitization: The skill implements read-only guardrails and advises parsing specific stable JSON fields.
Audit Metadata