onchain-pay-open-api
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled bash script (
scripts/sign_and_call.sh) to perform cryptographic signing and make authenticated API calls. This is a standard and secure approach to offload complex logic from the prompt. - [CREDENTIALS_UNSAFE]: The skill manages sensitive information including API keys and RSA private keys. It implements industry-standard practices by storing these in a local configuration file (
.local.md) and provides explicit instructions to the AI agent to mask keys in output and never reveal the private key path or contents. - [EXTERNAL_DOWNLOADS]: The skill makes network requests to
api.commonservice.io, which is a legitimate infrastructure domain used by Binance services. These operations are essential for the skill's primary function of processing crypto payments and querying order status. - [DATA_INGESTION_VULNERABILITY]: The skill processes user-defined parameters for payment orders. It mitigates indirect injection risks by instructing the agent to validate critical fields like destination addresses and networks before execution, and by using structured JSON payloads.
Audit Metadata