pionex-wallet

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill installs the @pionex/pionex-ai-kit package from the npm registry to provide the pionex-trade-cli and pionex-ai-kit binaries. These are official tools provided by the skill author.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes account data (such as account titles and balance values) retrieved from external Pionex APIs. This represents an attack surface where malicious instructions could theoretically be embedded in account metadata, though the risk is minimized by the read-only nature of the tool and the use of structured JSON data.
  • Ingestion points: Output from the pionex-trade-cli wallet balance_full command in SKILL.md.
  • Boundary markers: The skill expects structured JSON output, which limits the interpretation of free-text instructions.
  • Capability inventory: The skill is restricted to read-only balance retrieval; no file system writes or arbitrary command execution capabilities are present.
  • Sanitization: The instructions provide a specific summary logic that rounds values and iterates over defined JSON keys, reducing the likelihood of raw, unsanitized data influencing the agent's behavior.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:37 PM
Security Audit — agent-trust-hub — pionex-wallet