air-agentic-wallet
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides several Node.js scripts (e.g.,
air-send.mjs,air-approve.mjs,air-execute.mjs) designed for wallet operations. The agent is instructed to execute these scripts using thenodecommand to facilitate transactions and signing.\n- [DATA_EXFILTRATION]: To perform its primary function, the skill reads sensitive cryptographic keys from the local file system (e.g.,p256-private-key.pem) to generate local signatures. These signatures, along with wallet identifiers (e.g.,userId,walletId), are transmitted to an external signing API (airApiAgentSignUrl) and blockchain RPC/bundler endpoints. This behavior is consistent with the intended purpose of the wallet skill.\n- [EXTERNAL_DOWNLOADS]: The skill depends on theviemlibrary and interacts with external blockchain infrastructure and services, including the AIR signing API, Privy RPCs, and third-party bundlers like Candide.\n- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it processes untrusted data from external sources.\n - Ingestion points: External data enters the agent context through the JSON handoff bundle and various user-provided transaction parameters.\n
- Boundary markers: No specific delimiters or safety instructions are used to wrap or sanitize the external data within the prompts.\n
- Capability inventory: The skill possesses the ability to make network requests, read and write local configuration files, and execute cryptographic signing operations for on-chain execution.\n
- Sanitization: While the underlying scripts use the
viemlibrary to validate Ethereum addresses and hexadecimal data formats, the agent remains responsible for the secure passing of arguments to the scripts.
Audit Metadata