pyth
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of official SDKs from the Pyth Network ecosystem, including
@pythnetwork/hermes-client,@pythnetwork/pyth-solana-receiver, and the Rust cratepyth-solana-receiver-sdk. These dependencies are fetched from standard, trusted registries (NPM and Crates.io). - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process real-time financial data from external oracle price feeds, which represents an indirect injection surface.
- Ingestion points: External price data is fetched from the Hermes API (
https://hermes.pyth.network) inexamples/price-feeds/fetch-price.ts,templates/pyth-client.ts, andexamples/streaming/real-time-updates.ts. - Boundary markers: The instructions and examples demonstrate handling data through structured JSON formats and strongly-typed interfaces (TypeScript interfaces and Rust structs).
- Capability inventory: The skill provides templates for building and sending Solana transactions using
@solana/web3.js, where transaction logic depends on the fetched price data. - Sanitization: The skill emphasizes robust validation logic, providing helpers for staleness checks (
get_price_no_older_than) and confidence interval verification (validate_confidence) to mitigate risks from potentially inaccurate or manipulated oracle data. - [COMMAND_EXECUTION]: The documentation includes standard installation commands (
npm install) and execution examples for developer workflows. All commands target well-known, legitimate software development tools.
Audit Metadata