midnight-js

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for fetching zero-knowledge (ZK) configuration and contract assets from remote endpoints (e.g., indexer.preprod.midnight.network, indexer.preview.midnight.network, and indexer.mainnet.midnight.network). This is a standard and necessary operation for the functional requirement of proof generation and validation within the Midnight Network ecosystem.
  • [COMMAND_EXECUTION]: Includes instructions for running local development infrastructure, such as the Midnight proof server using Docker (docker run -p 6300:6300 midnightntwrk/proof-server:latest) and local testing environments via npm scripts. These are routine operations for blockchain developers setting up a headless or local testing node.
  • [INDIRECT_PROMPT_INJECTION]: The skill instructions define patterns for ingesting and processing user-supplied wallet seeds (seedHex) and transaction data.
  • Ingestion points: User input for wallet restoration and seed generation in SKILL.md (Sections 5 and 6).
  • Boundary markers: None explicitly mentioned in the code snippets, as they are implementation examples rather than full applications.
  • Capability inventory: The skill uses wallet SDKs to sign and submit transactions to the blockchain network via a relay URL.
  • Sanitization: Standard cryptographic validation is performed by the referenced SDK packages (e.g., @midnight-ntwrk/ledger-v8), which is appropriate for the domain.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 09:17 AM