token-allowance

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/allowance.py uses the subprocess.check_call method to execute a command-line operation that installs missing Python dependencies.
  • [EXTERNAL_DOWNLOADS]: If the web3 library is not present, the skill automatically downloads and installs it from the official Python Package Index (PyPI) via pip.
  • [CREDENTIALS_UNSAFE]: The tool accepts a private_key as a direct input parameter, which is a sensitive credential. While this is necessary for its functionality (signing blockchain transactions), providing private keys as plain-text arguments to tools can lead to exposure in agent logs or session histories. The skill also reads sensitive keys from the PRIVATE_KEY environment variable.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 07:53 PM
Security Audit — agent-trust-hub — token-allowance