cmc-x402

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing external Node.js packages, specifically @x402/axios, @x402/evm, and viem, to handle the x402 payment protocol and blockchain interactions for market data access.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of real-time cryptocurrency prices, listings, and DEX token information from CoinMarketCap. This external market data is untrusted and could potentially contain malicious content designed to influence the agent's logic.
  • Ingestion points: Market data fetched from pro.coinmarketcap.com endpoints listed in SKILL.md and references/endpoints.md.
  • Boundary markers: None are defined; the skill does not instruct the agent to distinguish between the fetched data and its own instructions.
  • Capability inventory: Network access to CoinMarketCap APIs and the ability to sign blockchain authorizations for payments.
  • Sanitization: No validation or sanitization steps are defined for the data retrieved from external endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 12:21 PM