cmc-x402
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing external Node.js packages, specifically
@x402/axios,@x402/evm, andviem, to handle the x402 payment protocol and blockchain interactions for market data access. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of real-time cryptocurrency prices, listings, and DEX token information from CoinMarketCap. This external market data is untrusted and could potentially contain malicious content designed to influence the agent's logic.
- Ingestion points: Market data fetched from
pro.coinmarketcap.comendpoints listed inSKILL.mdandreferences/endpoints.md. - Boundary markers: None are defined; the skill does not instruct the agent to distinguish between the fetched data and its own instructions.
- Capability inventory: Network access to CoinMarketCap APIs and the ability to sign blockchain authorizations for payments.
- Sanitization: No validation or sanitization steps are defined for the data retrieved from external endpoints.
Audit Metadata