meme-scout
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Instructions in
SKILL.mdprovide an example command that pipes content fetched from a remote URL (dexscreener.com) directly into a Node.js process for execution. - [DYNAMIC_EXECUTION]: The script
scripts/fetch-trending.jsusesvm.runInNewContext()to execute JavaScript code fragments that are scraped dynamically from a remote web page. - [COMMAND_EXECUTION]: The skill relies on shell command execution (
curl,sed,node) to perform its primary function of gathering and processing decentralized exchange data. - [EXTERNAL_DOWNLOADS]: Fetches live market data and security reports from well-known services including DexScreener, RugCheck, and Solana Tracker.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external websites. Ingestion points: Data enters via
curlinSKILL.mdandhttps.getinscripts/fetch-trending.js. Boundary markers: None identified to delimit external content from instructions. Capability inventory: Uses network requests and dynamic Node.js execution. Sanitization: Uses regex andvmparsing without robust validation of the content structure.
Recommendations
- HIGH: Downloads and executes remote code from: https://dexscreener.com/?rankBy=trendingScoreH24&order=desc - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata