moonpay-block-explorer
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses standard, well-known block explorer domains (such as etherscan.io, solscan.io, and mempool.space) to view blockchain data. These are established services in the cryptocurrency ecosystem.
- [SAFE]: The skill references the MoonPay CLI tool (
mp), which is a legitimate resource belonging to the skill's author. The commands provided follow standard development practices for retrieving and processing transaction data. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external command outputs to construct URLs that are opened in the user's browser.
- Ingestion points: The skill parses output from
mp token swap,mp transaction list, andmp buycommands inSKILL.md. - Boundary markers: The skill does not explicitly define boundaries for the data retrieved from the CLI tool.
- Capability inventory: The skill uses
open(macOS) andxdg-open(Linux) to launch URLs in the browser. - Sanitization: The provided shell examples use double quotes around variables (e.g.,
open "$URL") to handle whitespace, but there is no explicit validation of the URL scheme or content before execution.
Audit Metadata