ton-cli
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the
@ton/mcp@alphapackage from the NPM registry usingnpx. This is the core dependency for accessing TON blockchain tools.\n- [REMOTE_CODE_EXECUTION]: Code from the NPM registry is executed at runtime vianpx. This pattern is used to invoke specific tools likeget_balanceorsend_tondirectly from the command line.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to run the CLI commands. Theallowed-toolsfrontmatter configuration restricts this execution to the@ton/mcppackage scope.\n- [CREDENTIALS_UNSAFE]: The skill documentation describes how to use sensitive credentials, including 24-word mnemonics and hex-encoded private keys, which are passed to the tool via environment variables. It also references the local storage of wallet data in~/.config/ton/config.json. The instructions provide safety guidelines, requiring the agent to obtain user confirmation before executing any transaction commands.
Audit Metadata