altllm-portal-auth
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to interact with a local CLI tool using
node dist/cli.jsto manage wallet-based sessions. - [CREDENTIALS_MANAGEMENT]: The skill handles sensitive cryptographic private keys. It implements several security-conscious patterns:
- Recommends using environment variables (
--private-key-env) or local files (--private-key-file) to avoid leaking secrets in process listings. - Requires a specific safety flag (
--allow-unsafe-private-key-argv) if the user chooses to provide a private key directly as a command-line argument. - Stores session tokens in a dedicated local directory (
~/.altllm/portal-cli-session.json). - [INDIRECT_PROMPT_INJECTION]: The skill processes externally generated challenges for wallet signing. It includes a rule to validate the challenge structure (wallet, chain, and AltLLM login structure) before signing, which serves as a mitigation against malicious challenge payloads.
Audit Metadata