venice-x402
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEDATA_EXFILTRATIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is an integration guide for the Venice x402 payment system, providing instructions for wallet credit management, payment discovery, and settlement via USDC on the Base network.\n- [DATA_EXFILTRATION]: The skill facilitates access to sensitive wallet data, including balances and transaction history. This data access is secured by the requirement for SIWE (Sign-In With Ethereum) authentication headers, ensuring that only the wallet owner can retrieve their information from the Venice API.\n- [CREDENTIALS_UNSAFE]: The provided code samples demonstrate handling a wallet's private key via environment variables (process.env.WALLET_KEY). This is a standard and safe practice for secret management in development workflows and does not constitute a credential leak.\n- [EXTERNAL_DOWNLOADS]: The skill utilizes the x402 and venice-x402-client Node.js packages, which are protocol-specific libraries required for generating payment headers and interacting with the Venice payment infrastructure.\n- [PROMPT_INJECTION]: The skill creates an interface for processing structured data from API responses.\n
- Ingestion points: Data enters the agent context through balance and transaction endpoints (GET /x402/balance/{walletAddress} and GET /x402/transactions/{walletAddress}).\n
- Boundary markers: No specific delimiters for the ingested API data are defined.\n
- Capability inventory: The skill possesses network communication capabilities and performs cryptographic signing of transactions via the x402 SDK.\n
- Sanitization: No explicit sanitization or filtering of the API-provided data is documented.
Audit Metadata