metaplex
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: CRITICAL
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official Metaplex SDKs from the NPM registry. These packages, such as @metaplex-foundation/mpl-core and @metaplex-foundation/umi, are provided by a trusted organization and are standard for Solana development.
- [COMMAND_EXECUTION]: Example scripts include local file system access via fs.readFileSync. This is used for its intended purpose of loading local media files for NFT creation and metadata attachment, representing standard developer tool behavior.
- [DATA_EXFILTRATION]: The skill provides guidance on handling sensitive private keys using environment variables and wallet adapters. No patterns for unauthorized data transmission to external domains were identified; network operations are restricted to well-known Solana RPCs and decentralized storage endpoints.
- [SAFE]: References to external services like Irys (devnet.irys.xyz) and Arweave are standard for the Metaplex ecosystem. These are well-known services used for decentralized asset storage, and their inclusion in the development guide is consistent with industry best practices.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata