compound-v3-plugin

Pass

Audited by Gen Agent Trust Hub on May 12, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill retrieves updates and binary components from official GitHub repositories. The installation process is secured by an integrity check that calculates and compares the SHA256 checksum of the installation script before it is allowed to execute on the host system.
  • [COMMAND_EXECUTION]: Blockchain operations are performed via the onchainos CLI. The skill follows security best practices by enforcing a 'confirm gate' where all transaction-signing commands require an explicit confirmation flag to proceed, and provides a simulation mode for users to safely inspect transaction calldata.
  • [PROMPT_INJECTION]: The skill identifies blockchain metadata as a potential attack surface for indirect prompt injection. It includes a dedicated 'Data Trust Boundary' section that instructs the AI agent to treat all on-chain data (such as token names or transaction output) as untrusted external content, preventing the agent from interpreting it as system instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
May 12, 2026, 10:59 AM