skills/ton-org/skills/ton-cli/Gen Agent Trust Hub

ton-cli

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the @ton/mcp@alpha package from the NPM registry using npx. This is the core dependency for accessing TON blockchain tools.\n- [REMOTE_CODE_EXECUTION]: Code from the NPM registry is executed at runtime via npx. This pattern is used to invoke specific tools like get_balance or send_ton directly from the command line.\n- [COMMAND_EXECUTION]: The skill uses the Bash tool to run the CLI commands. The allowed-tools frontmatter configuration restricts this execution to the @ton/mcp package scope.\n- [CREDENTIALS_UNSAFE]: The skill documentation describes how to use sensitive credentials, including 24-word mnemonics and hex-encoded private keys, which are passed to the tool via environment variables. It also references the local storage of wallet data in ~/.config/ton/config.json. The instructions provide safety guidelines, requiring the agent to obtain user confirmation before executing any transaction commands.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 02:38 PM