opensea-tool-sdk
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill facilitates the creation and management of AI tools using official vendor libraries (@opensea/tool-sdk) and established blockchain protocols like ERC-8257.
- [SAFE]: Sensitive environment variables, such as PRIVATE_KEY and OPENSEA_API_KEY, are used solely for their intended cryptographic signing and API authentication functions.
- [SAFE]: A secure API key resolution process is implemented in SKILL.md, which caches fetched keys locally with restrictive file permissions (umask 077) to prevent unauthorized access.
- [SAFE]: All tool interfaces defined through the SDK use mandatory schema-based validation (via zod), providing a robust boundary against potential injection attacks from untrusted data.
- [SAFE]: Network operations are restricted to verified ProjectOpenSea API domains, reputable payment facilitators (PayAI, Coinbase CDP), and standard blockchain RPC endpoints.
- [SAFE]: Indirect Prompt Injection Surface Evaluation:
- Ingestion points: Tool handler inputs processed in handler.ts.
- Boundary markers: Strict JSON Schema enforcement via inputSchema and outputSchema.
- Capability inventory: Network operations (paidFetch) and CLI registration/payment utilities.
- Sanitization: Automated schema validation and type checking enforced by the SDK's creation wrappers.
Audit Metadata