onekey-market

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The instructions in references/common.md direct the agent to verify the presence of the @onekeyfe/cli package and install or update it globally via NPM if it is missing or outdated. This is an expected setup process for the vendor's tool.
  • [COMMAND_EXECUTION]: The skill relies on the onekey CLI for market analysis and wallet interactions. It utilizes dynamic command discovery via onekey schema to ensure that parameters and supported features are correctly identified at runtime, minimizing the risk of improper command usage.
  • [CREDENTIALS_UNSAFE]: The skill implements strict security rules that forbid the agent from asking for, echoing, or storing sensitive cryptographic information such as private keys, seed phrases, or mnemonics.
  • [PROMPT_INJECTION]: The skill contains internal logic to handle "Cross-Domain Fallback" requests. This allows the agent to process tasks outside the primary market domain (like wallet balance checks) by using the relevant onekey CLI commands rather than refusing the request, which is a standard functional routing feature.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 02:16 PM
Security Audit — agent-trust-hub — onekey-market