skills/sendaifun/skills/pyth/Gen Agent Trust Hub

pyth

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official SDKs from the Pyth Network ecosystem, including @pythnetwork/hermes-client, @pythnetwork/pyth-solana-receiver, and the Rust crate pyth-solana-receiver-sdk. These dependencies are fetched from standard, trusted registries (NPM and Crates.io).
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process real-time financial data from external oracle price feeds, which represents an indirect injection surface.
  • Ingestion points: External price data is fetched from the Hermes API (https://hermes.pyth.network) in examples/price-feeds/fetch-price.ts, templates/pyth-client.ts, and examples/streaming/real-time-updates.ts.
  • Boundary markers: The instructions and examples demonstrate handling data through structured JSON formats and strongly-typed interfaces (TypeScript interfaces and Rust structs).
  • Capability inventory: The skill provides templates for building and sending Solana transactions using @solana/web3.js, where transaction logic depends on the fetched price data.
  • Sanitization: The skill emphasizes robust validation logic, providing helpers for staleness checks (get_price_no_older_than) and confidence interval verification (validate_confidence) to mitigate risks from potentially inaccurate or manipulated oracle data.
  • [COMMAND_EXECUTION]: The documentation includes standard installation commands (npm install) and execution examples for developer workflows. All commands target well-known, legitimate software development tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 10:07 PM
Security Audit — agent-trust-hub — pyth