goldrush-mcp-skill
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the use of
npxto fetch the@covalenthq/goldrush-mcp-serverpackage from the npm registry. - [DYNAMIC_EXECUTION]: Runtime execution of the GoldRush MCP server is performed via
npx -y @covalenthq/goldrush-mcp-server@latest. - [COMMAND_EXECUTION]: The
uxctool is used to create persistent command aliases (uxc link) and manage authentication credentials (uxc auth). - [INDIRECT_PROMPT_INJECTION]: The skill processes external blockchain data, including NFT metadata and transaction history, which constitutes an attack surface.
- Ingestion points: Data is ingested through tool outputs from
goldrush-mcp-cli(e.g.,multichain_balances,nft_for_address). - Boundary markers: Instructions advise the agent to parse the JSON envelope (
ok,kind,data) before interpreting the content. - Capability inventory: The skill possesses the capability to execute shell commands via the linked
goldrush-mcp-cliand manage environment variables. - Sanitization: No explicit sanitization logic is provided in the validation scripts; the skill relies on the agent's ability to parse JSON structures safely.
Audit Metadata