opensea
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a suite of shell scripts and the
@opensea/clicommand-line tool to perform marketplace operations and data queries. These are intended functional behaviors for the OpenSea ecosystem. - [EXTERNAL_DOWNLOADS]: The skill facilitates the fetching of an API key from the official
api.opensea.ioendpoint and utilizes verified, scoped packages from the@opensearegistry via npx. - [DATA_EXFILTRATION]: Facilitates communication with official OpenSea API infrastructure (
opensea.io) to retrieve and submit NFT marketplace data, as required for its primary use case. - [PROMPT_INJECTION]: The skill implements proactive security measures, such as the use of explicit boundary markers, to sanitize and delineate untrusted user-generated content (like NFT metadata) returned from API responses.
- [CREDENTIALS_UNSAFE]: Provides detailed guidance for managing sensitive wallet signing credentials using environment variables, accompanied by comprehensive security warnings and best practices for utilizing managed providers (Privy, Turnkey, Fireblocks) to mitigate risks.
Audit Metadata