midnight-js
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for fetching zero-knowledge (ZK) configuration and contract assets from remote endpoints (e.g.,
indexer.preprod.midnight.network,indexer.preview.midnight.network, andindexer.mainnet.midnight.network). This is a standard and necessary operation for the functional requirement of proof generation and validation within the Midnight Network ecosystem. - [COMMAND_EXECUTION]: Includes instructions for running local development infrastructure, such as the Midnight proof server using Docker (
docker run -p 6300:6300 midnightntwrk/proof-server:latest) and local testing environments via npm scripts. These are routine operations for blockchain developers setting up a headless or local testing node. - [INDIRECT_PROMPT_INJECTION]: The skill instructions define patterns for ingesting and processing user-supplied wallet seeds (
seedHex) and transaction data. - Ingestion points: User input for wallet restoration and seed generation in
SKILL.md(Sections 5 and 6). - Boundary markers: None explicitly mentioned in the code snippets, as they are implementation examples rather than full applications.
- Capability inventory: The skill uses wallet SDKs to sign and submit transactions to the blockchain network via a relay URL.
- Sanitization: Standard cryptographic validation is performed by the referenced SDK packages (e.g.,
@midnight-ntwrk/ledger-v8), which is appropriate for the domain.
Audit Metadata