seeker-domains
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_SAFE]: The skill correctly identifies the risk of leaking sensitive RPC keys in mobile application builds (APKs) and provides detailed instructions for implementing a backend proxy to keep credentials secure.
- [COMMAND_EXECUTION]: The provided backend implementations (Express and Hono) include critical security controls, including origin allowlisting, request body limits, and per-IP rate limiting to prevent the proxy from being abused as an open relay.
- [DATA_EXPOSURE]: The skill provides explicit warnings and implementation logic to prevent data-related security issues, such as ensuring forward domain lookups (name to address) are not cached for payment destinations, which prevents funds from being sent to a domain's previous owner after a transfer.
- [INDIRECT_PROMPT_INJECTION]: The skill handles untrusted user input (domain names and wallet addresses) but mitigates injection risks by including robust validation logic and normalization (e.g., regex checks in
normalizeSkrNameand base58 decoding for addresses) before performing any on-chain queries. - [EXTERNAL_DOWNLOADS]: All external dependencies listed (such as
@solana/kit,@noble/hashes, and@onsol/tldparser) are standard, well-known libraries within the Solana development ecosystem.
Audit Metadata